JWT decoder
Read the header and payload of a JSON Web Token, right in your browser. Nothing is uploaded.
Files are processed in your browser and never uploaded.
How to use JWT decoder
Add your text
Type or paste your text into the input box. Everything is handled by your own browser, so nothing is sent to a server.
Read the result
The output updates as you type, so there is nothing to submit and nothing to wait for.
Copy or save it
Copy payload, Don puts the result on your clipboard.
What this tool does
Decode header and payload
The header and payload are Base64url decoded and pretty-printed, so you can read what a token actually claims.
Readable expiry and issued dates
The iat, nbf and exp timestamps are shown as readable dates instead of the Unix seconds they are stored as.
Expiry status at a glance
The page says whether the token is still valid or has expired, which is the first thing you want to know when a request is being rejected.
Fully private, nothing uploaded
The token is decoded in your browser and never sent anywhere, which matters because a JWT is a credential.
Works offline, no sign-up
Decoding is not verification: the signature is not checked here, so a decoded token is not a trusted one.
Frequently asked questions
Is my token uploaded anywhere?
No. The JWT is decoded entirely in your browser and is never sent to a server, so even sensitive tokens stay on your device. It works offline once loaded.
Does it verify the signature?
No. It decodes and shows the header and payload, but it does not check the signature, so a token that decodes is not proven to be authentic. Treat decoding as inspection only.
What do exp, iat and nbf mean?
They are standard time claims: exp is when the token expires, iat is when it was issued, and nbf is the earliest time it is valid. They are shown as readable dates with an expiry status.
Is it safe to paste a real token here?
Because everything stays in your browser, the token is not transmitted. Still, treat live tokens with care and avoid pasting them on shared or untrusted devices.
Why does my token fail to decode?
A JWT has parts separated by dots, encoded with base64url. If the token is truncated or altered, the parts cannot be decoded and a clear message is shown.
Last updated: