Tool 009 / dev / free / runs locally
JWT Decoder
Paste a JSON Web Token to see its decoded header and payload, pretty-printed as JSON. The token is decoded entirely in your browser and never leaves your device. This tool decodes only and does not verify the signature.
How it works
A JSON Web Token (JWT) is three Base64URL-encoded parts joined by dots: a header, a payload, and a signature. This tool splits the token on the dots, Base64URL-decodes the header and payload, and pretty-prints the JSON inside each. It runs entirely in your browser, so even a production access token you paste here never leaves your machine.
Base64URL is a URL-safe variant of Base64 that uses - and _ instead of + and / and usually drops padding, so the decoder substitutes those characters back and re-adds any missing padding before decoding. It also decodes as UTF-8 so non-ASCII claim values display correctly. Recognised time claims (exp, iat, nbf, auth_time) are pulled out and shown as human-readable UTC dates, since they are stored as raw Unix seconds.
Crucially, this tool decodes only and does not verify the signature. Decoding tells you what a token claims; it does not prove the token is authentic or untampered. Anyone can read a JWT payload, which is exactly why you must never put secrets in it.
How to use it
- Paste your JWT into the input box.
- Read the decoded Header and Payload, each pretty-printed as JSON.
- Check the Time claims panel to see when the token was issued and when it expires, in UTC.
- Compare the claims against what you expected; remember this does not check the signature.
Worked examples
Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature
Output: Header: {"alg":"HS256","typ":"JWT"} and Payload: {"sub":"1234567890"}
The third segment (the signature) is not decoded or checked.
Input: A token whose payload contains exp: 1700000000
Output: A Time claims row showing exp 1700000000 (Tue, 14 Nov 2023 22:13:20 GMT).
Time claims are interpreted as Unix seconds and printed in UTC.
Edge cases and limits
- Decode only: the signature is never verified, so a forged or expired token still decodes and displays. Validate signatures server-side.
- The token must have at least a header and a payload separated by a dot, or you get a clear error. A bare payload will not decode.
- Encrypted tokens (JWE) are not supported; this handles the common signed (JWS) format whose payload is readable.
- Time claims are read as seconds. A token that mistakenly stores them in milliseconds will show a date far in the future.
Common mistakes
- Believing that because a token decodes, it is valid. Decoding ignores the signature entirely.
- Pasting a token with surrounding quotes or a Bearer prefix. Strip Bearer and any quotes first.
- Putting sensitive data in a JWT payload assuming it is hidden. The payload is plainly readable by anyone, as this tool demonstrates.
Frequently asked questions
Does this JWT decoder verify the token signature?+
No. It only decodes the header and payload so you can read the claims. Verifying a signature requires the secret or public key and should be done on a trusted server, not in a public web page.
Is it safe to paste a JWT into this decoder?+
The decoding runs fully in your browser with JavaScript, and the token is never sent anywhere. Still, treat any live access token as a secret and avoid pasting one you are actively using into any online tool.
Why does my JWT show an expiry as a number?+
JWT timestamps like exp and iat are Unix epoch seconds. The decoder shows the raw payload, and it also displays a readable date for common time claims so you can tell whether a token is expired.
Related tools
More Developer tools that run entirely in your browser.