Tools · Text · JWT decoder
JWT decoder
Decode a JWT's header and payload to readable JSON entirely in your browser - exp, iat, and nbf render as real dates instead of epoch numbers, and the signature is shown exactly as received, never verified.
Runs fully in your browser. Nothing is uploaded.
Your file is ready.
Try a different file, or try again.
How it works
Paste your JWT.
Read the header, payload, and expiry.
Copy any part.
Frequently asked questions
No. Every JWT is decoded entirely in your browser - nothing is sent anywhere.
No, and it never will. Verifying a signature needs the secret or public key that issued the token, and asking a visitor for one on a public page is exactly the habit this tool avoids. The signature is shown exactly as received, never checked.
No. A JWT's payload is plain, readable Base64 - not encryption. Anyone holding the token can already read it without any tool, which is exactly why this page exists: to make that fact obvious, not to hide it.
As safe as decoding it by hand, and no safer than that - nothing is uploaded or stored. But a decoded token is still a credential: don't share it, and don't paste a real production token into any tool you don't trust, including this one.
Comments