Decode and inspect JSON Web Tokens. Check expiration and verify signatures locally in your browser.
Decode tokens fast
JSON Web Tokens (JWT) are used for authentication and secure data exchange. They consist of three parts: header (algorithm info), payload (claims), and signature. This tool decodes the header and payload, and can verify HS256/384/512, RS256/384/512, ES256, and ES384 signatures locally using the Web Crypto API - tokens, secrets, and keys never leave your browser.
The JWT Decoder reads a JSON Web Token and instantly shows you what's inside it — the header, the payload, and the raw signature — without sending the token anywhere. Paste a token and it splits the three dot-separated parts, Base64Url-decodes the header and payload into readable JSON, surfaces the common claims (issuer, subject, audience, issued-at, expiry), and tells you whether the token has already expired. Reach for it when you're debugging auth flows and need to confirm exactly what a token is asserting and when it lapses.
A JSON Web Token is a compact, URL-safe token used for authentication and passing claims between systems. It has three Base64Url-encoded parts separated by dots — header, payload, and signature — and this tool decodes the first two into readable JSON.
Yes. Decoding runs entirely in your browser using built-in Base64 decoding — your token is never uploaded, stored, logged, or sent to any server. That said, treat real tokens as secrets and avoid pasting production credentials into any third-party site.
No. It only decodes the header and payload so you can read them. It does not verify the signature, so a decoded token is not proof the token is authentic or untampered — signature verification requires the secret or public key on your server.
Yes. If the payload contains an exp claim, it converts the Unix timestamp to your local time and shows whether the token is still valid or has already expired. It also surfaces iat (issued at) and nbf (not before) when present.
It's completely free with no sign-up. A token is rejected if it isn't three dot-separated parts or if the header/payload aren't valid Base64Url-encoded JSON — that usually means the value was truncated, double-encoded, or isn't actually a JWT.