Decode a JWT, safely and privately
Paste a JSON Web Token to read its header, payload and claims in a clear, structured view — including issued-at and expiry times. It decodes entirely in your browser (0 uploads, works offline), so tokens that may contain sensitive claims never leave your device.
How to use it
- Paste your JWT into the box (or press Try an example).
- The header, payload and signature appear immediately in separate panels.
- Check the algorithm (
alg) and, if present, the expiry — the tool flags whether the token is expired against your device clock. - Copy any panel you need.
FAQ
How do I decode a JWT for free without uploading?
Paste the token here — it's split and Base64URL-decoded in your browser with local JavaScript, so nothing is sent to a server and there's no sign-up. It still works with your Wi-Fi off. This is ideal because a JWT can carry sensitive claims you don't want to paste into a random website that uploads it.
Does this verify the signature?
No — and that's deliberate. This tool decodes the token so you can read it; it does not verify the signature, because verification needs the signing secret or public key, which you should never paste into a web page. Treat the payload as claimed, not proven, until your server verifies it.
Is my token uploaded or logged?
No. Decoding happens on your device and nothing is stored — that's the whole point, since tokens are credentials.
What do exp, iat and nbf mean?
They're standard time claims in seconds since 1970: iat (issued at), exp (expiry), and nbf (not before). The tool renders them as readable UTC times and marks a token expired when exp is in the past.
Limits
Decodes standard three-part JWTs (header.payload.signature). Encrypted tokens (JWE) and malformed tokens can't be decoded — you'll get a clear typed error rather than a crash. Signature verification is out of scope by design.
Related
For related developer work, the Base64 and JSON formatter tools pair well with this decoder once they're live.
Bookmark this page (Ctrl+D, or ⌘D on Mac) or install the app — it works offline the next time you need it.