JWT Decoder
Decode any JWT's header and payload, verify the signing algorithm, and check whether the token is still valid — entirely in your browser.
How to decode a JWT
Paste a JWT (the long string of three base64 parts separated by dots) and its header and payload are decoded and pretty-printed instantly.
The tool also reads the exp claim so you can see at a glance whether the token has expired.
- Paste your JWT
- Header and payload are decoded
- Expiration status is shown
Is it safe to decode JWTs here?
Decoding only reads the un-signed payload — it does not verify the signature, so no secret is needed and nothing is sent anywhere. Everything happens locally.
Frequently Asked Questions
Does this verify my JWT signature?
No — it only decodes the header and payload for inspection. Signature verification requires the secret key, which this client-side tool never needs or requests.
Will my token be uploaded?
No. Decoding happens entirely in your browser.
What does the expiration status mean?
If the token includes an exp claim, the tool compares it with the current time to show valid/expired status.