JWT Decoder
Decode a JSON Web Token to inspect its header and payload. Free and private, right in your browser. Signatures are never verified.
Paste a JWT and instantly see its decoded header and payload as readable JSON, handy when you're debugging an auth flow, checking what claims an access token actually carries, or verifying an expiry date without writing a script.
How to use it
- Paste your JWT string into the input box
- View the decoded header and payload as formatted JSON
- Check claims like exp, iat, or sub at a glance
Frequently asked questions
- Is my token sent anywhere?
- No. Decoding happens entirely in your browser. The JWT never leaves your machine, which matters since payloads often contain user IDs, emails, or scopes.
- Can this tool verify the signature?
- No, it only decodes the header and payload (base64url-decoded JSON) for inspection. Verifying the signature requires the secret or public key, which this tool doesn't ask for.
- Why does my payload show exp or iat as a number instead of a date?
- Those are Unix timestamps (seconds since epoch) as defined by the JWT spec. The decoder shows the raw value; convert it yourself or check the field name against RFC 7519 to know what it means.
- 1
Nothing is uploaded
The file never leaves your device. There is no server to send it to, so there is nothing to leak, log, or subpoena.
- 2
No signup, no limits
No account, no email, no daily cap, no watermark, and no paid tier waiting behind the third file.
- 3
Works offline
Load the page once and it keeps working with the network off, because all the work was always happening locally.