JWT Decoder
Paste a JSON Web Token (JWT) below to instantly decode its header and payload. Decoding happens entirely in your browser — your token is never sent anywhere.
How to Use the JWT Decoder
- Paste a full JWT (three Base64URL segments separated by dots) into the box above.
- The decoded Header and Payload JSON appear instantly below.
- Check standard claims like
exp(expiry) andiat(issued-at) shown in the meta section, converted to readable dates. - Use the Copy buttons to grab either section for debugging.
Why Use This Tool?
Is my token uploaded anywhere?
No. Decoding is pure client-side Base64URL parsing done in your browser's JavaScript engine. Your token, and anything inside it, is never transmitted, logged, or stored on any server — it disappears when you close or refresh the page.
Does this verify the token's signature?
No. This tool only decodes the header and payload for inspection — it does not verify the signature against a secret or public key, since that would require knowing your API's private signing key (which should never be pasted into any third-party website). Use this purely to read claims during development and debugging, not to validate trust in a token from an untrusted source.
Who uses a JWT decoder?
Backend and frontend developers debugging authentication flows, checking token expiry, inspecting custom claims, or verifying that an API is issuing the right payload structure all reach for a quick JWT decoder rather than writing a one-off script.
What if I get an error?
A JWT must have exactly three dot-separated Base64URL segments (header.payload.signature). If you see an error, double-check you've pasted the complete token without extra whitespace or line breaks.