JWT Decoder

Paste a JSON Web Token and instantly see its decoded Header and Payload as formatted JSON. This decodes content only — it does not verify the signature, so it never confirms a token is authentic or unmodified. Processing happens entirely in your browser.

Developer Tools Runs entirely in your browser

The token is decoded entirely on your device, and is never sent to any server.

Decoding the token's content does not mean verifying the signature — this tool only shows the Header and Payload content, and does not verify that the token was issued by a trusted party or hasn't been tampered with.

JWT

What this tool does

Decodes a JWT and shows what is inside it: the header giving the signing algorithm, the payload with its claims, and the issued-at and expiry times.

When to use it

Debugging an authentication problem and wanting to see what the token actually carries.
Checking the expiry of a token that seems to have stopped working.
Understanding the structure of a token issued by a third-party service.
Confirming the permissions embedded in a token are the ones you expect.

How to use it

Paste the token into the field.
Click decode and read the header and payload.

A practical example

Input

A JWT from a sign-in response.

Output

The signing algorithm from the header, the subject, name and claims from the payload, and the expiry rendered as a readable date.

Limitations

This decodes and does not verify the signature — it has no secret key. A tampered token will display its contents in full despite being invalid.
A JWT payload is Base64-encoded, not encrypted: anyone holding the token can read what is inside, which is why secrets must never go in a payload.
A truncated or malformed token is rejected with a clear message.

Privacy and processing

The token is decoded entirely on your device and is never sent to any server — which is fundamental, because pasting a real access token into an outside site means handing over an account.