JWT Decoder
Free JWT decoder — decode and inspect the header and payload of a JSON Web Token, including expiry, entirely in your browser. Nothing is uploaded.
Runs entirely in your browser — nothing you enter is uploaded or stored.
Decode any JSON Web Token
Paste a JWT to instantly read its header and payload as pretty-printed JSON, plus a human-readable view of the standard time claims (iat, nbf, exp).
This tool does not verify the signature. Decoding a JWT is not the same as trusting it — anyone can read a token's contents. Only a server holding the secret (HMAC) or the correct public key (RSA/EC) can confirm the token is genuine and untampered. Never make security decisions based on a decoded-but-unverified token.
Frequently asked questions
Does this verify the signature?
No. This tool only DECODES the JWT — it splits and base64url-decodes the header and payload. Verifying the signature requires the signing key (or public key), which the tool never has. Do not trust a decoded token as authentic.
What do the dates mean?
iat = issued-at, nbf = not-before, exp = expiry. They are stored as seconds since the Unix epoch; the tool renders them as UTC dates and flags whether the token is currently expired.
Is my token uploaded?
No — everything runs locally in your browser. Nothing leaves the page.
Why does decoding fail?
A valid JWT has three dot-separated parts (header.payload.signature), each valid base64url, and the first two must be valid JSON. If any of that is off, an error is shown.