JWT Decoder
Read the header and payload of a token — locally.
JWT Decoder splits a JSON Web Token into its header, payload and signature, decodes the first two from Base64URL and formats them, and converts the timestamp claims into readable dates with an expiry check. It decodes only; it does not verify signatures, and it never transmits the token.
Loading JWT Decoder…
Runs entirely on your device. No file or text you enter here is uploaded. How to verify it.
How to use JWT Decoder
- Paste the token.
- Read the decoded header and payload with expanded claims.
- Check the expiry and issued-at times.
Questions about JWT Decoder
Why does it not verify the signature?
Verification needs the secret or public key. Pasting a production signing secret into a web page is a worse idea than the problem it solves, so this tool deliberately stops at decoding. Verify server-side, with your key, in your own environment.
Is it safe to paste a real token here?
Safer than anywhere with a server, because nothing leaves your browser — check the network tab. But a JWT is a live credential: anyone who reads it over your shoulder or out of your clipboard history can use it until it expires. Prefer expired or test tokens.
Is a JWT encrypted?
No. A standard signed JWT is Base64URL-encoded JSON that anyone can read. The signature proves it was not altered; it does not hide the contents. Never put secrets in a JWT payload.
Can it decode a token that has already expired?
Yes. Expiry is a claim inside the payload, not something that blocks decoding, so an expired token reads exactly like a live one — the difference is that the tool marks the
exp claim as past and says how long ago.Does it work with tokens from any provider?
Any standard signed token in the three-part header.payload.signature form decodes, whoever issued it. Encrypted JWE tokens are a different five-part structure whose payload cannot be read without the key, so the decoder reports that the payload is not readable JSON rather than inventing claims.
Is JWT Decoder really free, with no limits?
Yes. There is no account, no daily cap, no file-size tier and no watermark, because there is no server cost to recover. The site is funded by clearly disclosed partner recommendations on the Partners page, never by metering the tools.
Are my files or text uploaded when I use JWT Decoder?
No. Everything is processed by JavaScript running in your browser, on your device. You can verify it: open your browser's developer tools, switch to the Network tab, and use the tool. You will see no request carrying your data — because there is nowhere for it to go.