JWT Decoder
Decode a JSON Web Token's header and payload instantly, with every claim shown in a readable table (Unix timestamps converted to real dates) and a clear expired/valid indicator read from the exp claim. Doesn't verify the signature — that needs the issuer's secret or key, which this tool never asks for, since decoding and verifying are genuinely different guarantees. Runs entirely client-side — nothing is uploaded.
About this tool
This tool decodes a JSON Web Token (JWT) — the header and payload, both instantly readable, plus a table of every claim with Unix timestamps converted to real dates and a clear expired/valid indicator read from the exp claim. A JWT is three base64url-encoded parts joined by dots (header.payload.signature); the header and payload are just JSON, easy to decode, but they're not encrypted — anyone holding a JWT can already read its contents, which is exactly why this tool needs no secret key to show you what's inside one. What it deliberately doesn't do is verify the signature: that would need the issuer's secret (for HMAC algorithms) or public key (for RSA/ECDSA), and this tool never asks for either — decoding and verifying are genuinely different operations, and conflating them risks someone trusting an unverified token's contents as if they were confirmed authentic. It runs entirely client-side — the token you paste is decoded locally in your browser and never uploaded anywhere.
What you can do
- Decode a JWT's header and payload instantly as you paste it
- See every claim in a readable table, with dates converted from Unix timestamps
- Clear expired/valid status at a glance, from the exp claim
- Copy the decoded header or payload as JSON
- Nothing is uploaded — decoding happens entirely in your browser
How to use
Step 1
Paste a JWT
Paste the full token — decoding happens instantly, no button to press.
Step 2
Inspect it
See the header and payload as formatted JSON, plus every claim in a readable table with human dates.
Step 3
Copy if you need to
Copy the header or payload JSON individually.
Example
A JWT's payload, once decoded, is just JSON like this:
Decoded payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}The header and payload are readable to anyone with the token, encoded but not encrypted — that's what makes JWTs unsuitable for storing genuinely secret data, and exactly why this tool can decode one without needing any key at all.
How your data is handled
This tool is labeled 🟢 Browser: the token you paste is base64url-decoded and parsed directly in your browser — nothing is uploaded to a server, and nothing about it is retained once you leave the page.
Frequently asked questions
Does this verify the token's signature?+
No, deliberately. Verifying a signature needs the issuer's secret (HMAC algorithms like HS256) or public key (RSA/ECDSA algorithms like RS256/ES256) — this tool never asks for either, since a decoder that let you paste in "any" secret to check against could too easily be mistaken for confirming a token is genuinely authentic. Decoding just shows you what's inside; verifying confirms it hasn't been tampered with — those are different guarantees.
Why does it say "Expired" or show no expiry status at all?+
The status comes directly from the payload's exp claim (a Unix timestamp) compared against the current time. If a token has no exp claim, there's nothing to check — some tokens are intentionally issued without an expiry.
Is a JWT's payload encrypted?+
No — it's base64url-encoded, not encrypted, and readable by anyone who has the token (this tool decoding it without any key is proof of that). Never put genuinely secret data in a JWT payload.
Why does it say the token is invalid?+
A JWT needs exactly three dot-separated parts, each valid base64url, and the header/payload each need to decode to a JSON object — the error message names exactly which requirement wasn't met.
Is my token uploaded anywhere?+
No — it's decoded directly in your browser using standard base64url decoding and JSON.parse. Nothing you paste here ever leaves your device.