JWT decoder
Decode a JWT's header and payload to readable JSON entirely in your browser - exp, iat, and nbf render as real dates instead of epoch numbers, and the signature is shown exactly as received, never verified.
Add a file and run the tool.
Your file is ready.
Try a different file, or try again.
Settings
Adjust the settings below. The result updates as you go.
Runs fully in your browser. Nothing is uploaded.
Runs fully in your browser. Nothing is uploaded.
How it works
Paste your JWT.
Read the header, payload, and expiry.
Copy any part.
Frequently asked questions
No. Every JWT is decoded entirely in your browser - nothing is sent anywhere.
No, and it never will. Verifying a signature needs the secret or public key that issued the token, and asking a visitor for one on a public page is exactly the habit this tool avoids. The signature is shown exactly as received, never checked.
No. A JWT's payload is plain, readable Base64 - not encryption. Anyone holding the token can already read it without any tool, which is exactly why this page exists: to make that fact obvious, not to hide it.
As safe as decoding it by hand, and no safer than that - nothing is uploaded or stored. But a decoded token is still a credential: don't share it, and don't paste a real production token into any tool you don't trust, including this one.
Guides
A closer look at specific problems this tool solves.
Why APIs Traded Server-Side Sessions for a Signed Token
A server-side session is simple and instantly revocable, but it needs a lookup every single server can reach on every request. A JWT trades that lookup for a signature - and gives up instant revocation to get it.
Read the guideHow to Check Whether a JWT Has Expired, Without Doing the Epoch Math Yourself
A JWT's exp claim is a raw Unix timestamp - meaningless at a glance. Paste a token and the expiry, not-before, and issued-at claims come back as real dates with a plain valid/expired/not-yet-valid label, no manual conversion required.
Read the guideDebugging a 401 by Reading What Your JWT's Claims Actually Say
A request that worked five minutes ago now returns 401, and the token looks fine at a glance. The fastest way to find out what changed is to decode it and read the claims in order, not guess.
Read the guide
Comments