JWT Decoder
Decode and inspect JSON Web Token headers, payloads, claims and expiry safely.
Decode and Inspect JSON Web Tokens
A JSON Web Token is three Base64url-encoded parts joined by dots: a header naming the signing algorithm, a payload of claims, and a signature. The first two are merely encoded, not encrypted — anyone holding the token can read everything inside it. Only the signature offers any protection, and it proves the token has not been altered, not that its contents are secret.
This decoder splits the token, renders the header and payload as formatted JSON, explains each registered claim in plain language, and tells you whether the token has expired. It does all of this locally, which is the only responsible way to handle a token.
Key features
- Header and payload decoded — as formatted, readable JSON.
- Claim explanations —
iss,sub,aud,exp,nbf,iatandjtidescribed in plain English. - Expiry checking — timestamps converted to local time with a clear expired or valid verdict.
- Bearer prefix tolerated — paste straight from an Authorization header.
- Nothing transmitted — decoding is pure client-side string work.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: JWT Decoder
- Paste your token
A leading "Bearer " is stripped automatically, so you can paste an Authorization header as-is. - Read the header
The <code>alg</code> field names the signing algorithm. A token claiming <code>alg: none</code> is a well-known attack pattern and should be rejected outright. - Inspect the claims
The table lists every claim with its value and meaning, converting timestamps to readable dates. - Check the expiry verdict
The banner states whether the token is still valid and exactly when it expires.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Developer |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
Is a JWT encrypted?
No. A standard JWT is signed, not encrypted — the payload is plain Base64url that anyone can read. Never put passwords, payment details or personal data in a JWT payload. If you genuinely need confidentiality, use JWE rather than JWS.
Can this tool verify the signature?
No, and no browser tool responsibly can. Verification needs the signing secret or public key, and pasting your secret into a web page would compromise it. Verify on your server, where the key lives.
Is it safe to paste a token here?
This page never transmits it — everything runs in your browser and you can verify that by disconnecting from the network. Even so, treat any live token as a credential: prefer an expired or test token, and rotate anything you have pasted into any online decoder.
What do exp, iat and nbf mean?
They are Unix timestamps in seconds. <code>exp</code> is when the token expires, <code>iat</code> when it was issued, and <code>nbf</code> the earliest time it becomes valid. A correct implementation checks all three, not just expiry.