JWT Decoder
Decode a JWT's header and payload without verifying it.
Your decoded header and payload appear here
Paste a JWT on the left and click Decode. The header and payload are base64url-decoded and pretty-printed in your browser — the signature is never checked and nothing is sent to a server.
Runs entirely in your browserDecode a JWT header and payload, locally
A JSON Web Token is three base64url-encoded parts joined by dots: a header, a payload of claims, and a signature. This tool splits the token, decodes the first two parts, and pretty-prints the JSON so you can read the algorithm, the claims, and expiry at a glance. Common timestamp claims like exp, iat, and nbf are also shown as human-readable dates. Decoding is not the same as verifying — this tool never checks the signature, so never trust a token's contents on decoding alone. Everything runs in your browser and nothing is uploaded to any server.
Common questions
How does the decoder work?
It splits the token on dots into three parts, base64url-decodes the first (header) and second (payload) parts into text, parses each as JSON, and pretty-prints the result. The third part, the signature, is left untouched.
Does this verify the token's signature?
No. Decoding only reveals what a token says; it does not prove the token is authentic. Verifying a JWT requires the signing secret or public key and must happen on a trusted server. Treat decoded contents as unverified.
What do the exp, iat, and nbf fields mean?
They are Unix timestamps: iat is when the token was issued, nbf is the earliest time it is valid, and exp is when it expires. The tool shows each as a readable date so you can spot an expired token quickly.
Should I paste production tokens here?
Never paste real production tokens or secrets into any online tool. Even though this decoder runs entirely in your browser and uploads nothing, a live token grants access — use a test token, or a token whose session you can revoke.
Is my token uploaded anywhere?
No. The token is split and decoded entirely in your browser tab with JavaScript. Nothing you paste is uploaded or stored on a server — but see the note above about not pasting production secrets anywhere.