JWT Decoder
Paste a JSON Web Token to inspect its header and payload. Decoding happens entirely in your browser, and the token is never sent anywhere.
The signature is not verified. This tool only decodes the token; it cannot check authenticity without the signing key.
How to decode a token
- Paste the JWT into the Token box.
- The decoded Header and Payload appear pretty-printed, with the raw Signature below them.
- Check “Standard claims” for the issued-at, expires, and not-before times as readable dates; an expired or not-yet-valid token is flagged.
- Copy any section you need.
When to use it
Reach for it while debugging authentication, to read what a token actually carries: which claims are set, which user or scopes it names, and when it expires. Seeing the payload laid out is faster than decoding the Base64 segments by hand.
It decodes a token but does not verify its signature, because that needs the signing key the server holds. So use it to see what a token says, not to trust that the token is genuine. A JWT is a credential, so avoid pasting a production token into any tool you don’t control.
Frequently asked questions
Does it verify the token’s signature?
No. It only decodes the header, payload, and signature for inspection. Verifying the signature requires the signing key, which a client tool doesn’t have.
What does it show?
The pretty-printed header and payload, the raw signature, and the standard time claims (iat, nbf, exp) as readable dates.
Will it tell me if a token is expired?
Yes. It flags a token whose “exp” is in the past, or whose “nbf” is still in the future.
Is it safe to paste a token here?
The token is decoded entirely in your browser and never uploaded. Treat any JWT as a secret and avoid pasting production tokens into tools you don’t control.