JWT Decoder
Read what is inside a JSON Web Token.
Runs entirely in your browser — your data is never uploaded to any server.
How it works
- Paste your tokenThe full three-part JWT.
- Decode itHeader and payload are shown as JSON.
- Inspect the claimsTimestamps are shown as real dates.
What this tool does
- Separate header, payload and signature display
- Standard claims explained in plain language
- Expiry status calculated against the current time
- Local decoding — production tokens stay private
Frequently Asked Questions
No. Verification requires the secret or public key, which should never be pasted into a web tool. This decodes and displays the contents only.
Decoding happens in your browser with no network request. Even so, treat live tokens as credentials and revoke anything you are unsure about.
JWT payloads are encoded, not encrypted. The signature proves the token was not tampered with — it does not hide the contents.
Expiry time and issued-at time, both as Unix timestamps. This tool converts them to readable dates.
Privacy and security
Your input is processed by JavaScript running inside your browser. Nothing you paste is sent over the network, logged, or stored — which is what makes this safe to use with production data. If you want to check this yourself: open your browser’s developer tools, switch to the Network tab, and use the tool — you will see no request carrying your file or input leave the page.