JWT Decoder
Decode a JSON Web Token's header and payload, and see expiry status, entirely in your browser.
How to use this tool
Paste a JWT (three Base64URL segments separated by dots) — the decoded header and payload appear below, along with expiry status if the token has an "exp" claim.
About this tool
A JWT's header and payload are Base64URL-encoded JSON, not encrypted, so decoding them requires no key. This tool only decodes and displays them — it does not verify the cryptographic signature, which would require the issuer's secret or public key.
100% client-side. The token you paste is never uploaded, logged, or stored.
Frequently asked questions
Does this verify the JWT signature?
No. This tool only decodes the header and payload, which are just Base64URL-encoded JSON, not encrypted — anyone can read them without a key. Verifying the signature requires the issuer's secret or public key, which this tool never asks for or has access to.
Is it safe to paste a real JWT here?
Decoding happens entirely in your browser and the token is never sent anywhere. That said, treat access/session tokens as sensitive — avoid pasting production tokens into any tool, including this one, if you can use a test token instead.