JWT Decoder
Paste a JSON Web Token to instantly see its decoded header and payload, plus readable issued-at and expiry times. It all happens in your browser, so your token — and any data inside it — never leaves your device.
- 🔒 100% private — no uploads
- 🆓 Free, no watermark
- 📱 Works on any device
How to decode a JWT
- 1
Paste your JWT
Drop the whole token (three dot-separated parts, starting eyJ…) into the box. It’s decoded right in your browser — never sent to a server.
- 2
Read the header & payload
Both are shown as formatted, collapsible JSON, and the time claims (iat, nbf, exp) are turned into readable dates with an expired / not-expired status.
- 3
Copy what you need
Expand the claims you care about and copy any value. Nothing is stored — refresh and it’s gone.
Why use JWT Decoder?
Header, payload & claims
See the algorithm and type from the header, every claim in the payload, and iat/nbf/exp turned into real dates with an expiry check.
Decoded, never sent
Unlike some online decoders, your token is processed locally — it never touches a server, so it’s safe for real access tokens.
100% private
Everything runs locally in your browser with JavaScript. Your input is never uploaded, stored or seen by anyone — it even works offline once the page has loaded.
Works on any device
No install and no account. Runs in any modern browser on Windows, macOS, Linux, Android or iPhone.
The anatomy of a JWT
A JSON Web Token is three Base64URL strings joined by dots. The header names the signing algorithm (alg) and token type; the payload carries the claims — registered ones like iss (issuer), sub (subject), iat (issued at) and exp (expiry), plus whatever custom fields the issuer added; the signature lets the server prove the first two parts weren’t altered. Only the signature involves a secret — the header and payload are readable by anyone, which is exactly what this decoder shows.
Debugging tokens without leaking them
A live access token is a credential: whoever holds it can act as its owner until it expires. Pasting one into a random website’s decoder hands it to that site’s server. Because this decoder runs entirely in your browser, the token never leaves your machine — so checking why a request gets a 401 (expired exp? wrong aud? missing scope?) doesn’t require trusting anyone with the token itself.
Frequently asked questions
Does this verify the token’s signature?
No. It decodes the header and payload so you can read them; it does not verify the signature. Verifying needs the secret or public key and should be done on your server — pasting a signing secret into any website is unsafe.
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser using base64url, so the token never leaves your device — safe even for live access tokens, and it works offline once loaded.
What is inside a JWT?
A JWT has three base64url parts separated by dots: a header (algorithm and type), a payload (the claims, such as sub, iat and exp), and a signature. The header and payload are only encoded, not encrypted — anyone can read them, which is why this decoder needs no key.