JWT Decoder
Decode a JSON Web Token to inspect its header and payload. 100% local - nothing leaves your browser.
About
Paste any JSON Web Token and this tool splits it into its three parts - header, payload and signature - then Base64URL-decodes and pretty-prints the header and payload as readable JSON. Claims like exp, iat and nbf are converted to human-readable dates with a clear valid/expired/not-yet-valid status.
It decodes only - it does not verify the signature, since that requires the signing key. Everything happens locally in your browser, so tokens from production systems never leave your device.
Frequently Asked Questions
About the JWT Decoder.
No. This JWT decoder runs entirely in your browser using local JavaScript. Your token is never uploaded, logged, or transmitted anywhere - it never leaves your device. This makes it safe to paste production access tokens that contain sensitive data.
No. This tool only decodes the header and payload so you can read their contents. It does not verify the cryptographic signature, because verification requires the secret or public key that signed the token. A decoded JWT is not proof that the token is authentic or untampered.
A JSON Web Token has three Base64URL-encoded parts separated by dots: header, payload, and signature. The decoder splits the token on the dots, Base64URL-decodes the header and payload segments, and parses each as JSON. The signature stays encoded because it can only be checked with the signing key.
These are standard registered JWT claims expressed as Unix timestamps (seconds since 1970). "iat" is when the token was issued, "exp" is when it expires, and "nbf" ("not before") is the earliest time it becomes valid. This tool converts them to human-readable dates and shows whether the token is currently valid, expired, or not yet valid.
The tool compares the token's "exp" claim against your device's current clock. If the expiry time has already passed, the token is shown as expired. Decoding still works for expired tokens - you can always read their contents - but most servers will reject an expired token.
Decoding is algorithm-agnostic: HS256, RS256, ES256, EdDSA and any other "alg" value all decode the same way, since the header and payload are just Base64URL-encoded JSON regardless of how the signature was produced. The tool displays the "alg" value from the header so you can see how the token was signed.