JWT decoder
Read the header and payload of a token without sending it anywhere.
- Runs in your browser — your text is never sent anywhere
- No sign-up, no quotas, free to use as often as you like
How it works
Pasting a JWT into a website is a genuinely bad habit: a live token is a credential, and you have just handed it to a third party. This decodes it in the page, so the token never leaves your machine.
What a JWT contains
Three Base64URL segments separated by dots: a header naming the algorithm, a payload of claims, and a signature. The first two are encoded, not encrypted — anyone holding the token can read them.
Signature verification is not decoding
This shows what the token says. It does not verify that the signature is valid, because that needs the signing secret or public key. A decoded token proves nothing about authenticity.
Expiry
Where the payload carries an expiry claim, it is shown as a readable date and flagged if it has already passed — usually the thing you were trying to find out.
JWT decoder — questions
Does this verify the signature?
No. Verification needs the signing key. This decodes and displays the contents only.
Is my token sent to a server?
No, which is the point. A live token is a credential and should not be pasted into a remote service.
Why can anyone read a JWT?
The header and payload are Base64-encoded, not encrypted. The signature prevents tampering, not reading.