JWT Decoder
Paste a JSON Web Token to decode its header and payload. Everything runs locally in your browser — nothing is uploaded, logged, or stored.
Header
Payload
Claims
Decode a token to see its registered claims.
Signature
This tool decodes but does not verify the signature — verification needs the secret or public key, which should never be pasted into a web page.
How to use this tool
- Paste your JSON Web Token into the input box. It can include or omit the
Bearerprefix — strip it first if present. - The header and payload decode automatically as you type. No button to press.
- Check the status banner for expiry: green means the token is still valid, red means
exphas already passed. - Read the Claims table for a plain-English view of
iss,sub,aud,exp,iatandnbf, with Unix timestamps converted to readable UTC dates. - Copy the signature if you need it, but verify it server-side — never paste a signing secret into any web tool, including this one.
A JSON Web Token is three Base64URL-encoded segments joined by dots: a header describing the signing algorithm, a payload carrying the claims, and a signature proving the first two have not been altered. Because the first two segments are only encoded and not encrypted, anyone holding a token can read its contents — which is exactly what this decoder does.
That has an important security consequence that trips up a lot of teams: a JWT payload is public. Do not put passwords, API keys, credit card numbers, or personal data you would not want exposed into a token payload, because any recipient can decode it in seconds. The signature protects against tampering, not against reading.
The most common reason developers reach for a decoder is debugging an authentication failure. A 401 from your API usually comes down to one of three things: the exp claim has passed, the aud claim does not match what the receiving service expects, or the alg in the header is not the algorithm your verification code accepts. This tool surfaces all three at a glance.
Pay particular attention to the alg field. A token arriving with alg: none is a classic attack signature — it asks the verifier to skip signature checking entirely. Any production verifier should hold an explicit allowlist of accepted algorithms rather than trusting whatever the token declares.
This decoder runs entirely in your browser using the native atob and TextDecoder APIs. There is no server call, no logging, and no analytics on the token you paste. You can confirm this by opening your browser devtools Network tab while decoding — you will see zero requests. Even so, treat production tokens as live credentials and rotate anything you paste into any online tool.
Frequently asked questions
Is it safe to paste a JWT into an online decoder?
This one is safe in the technical sense — decoding happens locally in your browser with no network request, which you can verify in devtools. But a JWT is a live credential until it expires. The prudent habit is to decode expired or test tokens online and use a local CLI for production tokens. Never paste your signing secret anywhere.
Can this tool verify the token signature?
No, deliberately. Verifying a signature requires the HMAC secret or the RSA/ECDSA public key. Asking you to paste a signing secret into a web page would be poor security practice, so this tool decodes only. Verify signatures in your backend, where the key already lives.
Why does my token show as expired when I just generated it?
Almost always clock skew or a units mistake. The exp claim is in seconds since the Unix epoch, not milliseconds — if you passed Date.now() in JavaScript without dividing by 1000, your expiry lands in the year 57000 or fails validation outright. Check the decoded Expires-at date; if it looks absurd, that is your bug.
What is the difference between JWT, JWS and JWE?
JWS (JSON Web Signature) is the signed-but-readable format nearly everyone means when they say JWT — three segments, payload visible. JWE (JSON Web Encryption) is the encrypted variant with five segments and an unreadable payload. This decoder handles JWS. If your token has five dot-separated parts, it is JWE and cannot be decoded without the decryption key.
Does the token get sent to your server?
No. There is no server component to this tool at all. The page ships static HTML, CSS and JavaScript; the decode runs in your browser’s JavaScript engine. Nothing about the token is transmitted, stored, or logged.