JWT Decoder
Decode a JSON Web Token in your browser. Nothing is uploaded. Signature is not verified.
Paste a JWT, then decode.
Header
{}
Payload
{}
What this tool does
A JWT is three base64url segments: header, payload, and signature. This page decodes the first two and pretty-prints the JSON. It does not check the signature, so a decoded token is not a verified token.
FAQ
Does this JWT decoder send my token to a server?
No. Decoding runs in your browser with JavaScript. The token never leaves this page.
Does this tool verify the JWT signature?
No. It only base64url-decodes the header and payload. A valid-looking payload is not proof the token is authentic. Use this to inspect claims, not to trust them.
What format does a JWT have?
Three base64url parts separated by dots: header.payload.signature. Encrypted JWEs are not supported here.
Can I decode expired tokens?
Yes. Expiration is a claim in the payload. This tool shows exp, iat, and nbf as UTC timestamps when they are numeric. It does not reject expired tokens.
Do I need an account?
No account, no upload, no install. Paste a JWT and decode it.