JWT Decoder
Read the header and payload of a JSON Web Token, with readable dates and expiry status.
Loading tool…
How to use
- Paste a token (with or without the “Bearer ” prefix).
- See the header, payload and each claim, with timestamps shown as dates.
- Check the expiry status — remembering it says nothing about authenticity.
How it works
A JWT’s header and payload are only Base64URL-encoded JSON, so anyone can read them. Its signature proves who issued it, but checking it requires the issuer’s secret or public key. This tool deliberately only decodes, and it never sends your token anywhere.
Limitations
- Signatures are not verified — never trust decoded claims on their own.
- Encrypted tokens (JWE) cannot be read without their key.
Privacy
Tokens are decoded entirely in this browser tab and are never uploaded or saved. Still, avoid pasting live production tokens into any website you do not control.
Local processing protects your data from being uploaded, but it cannot protect against a compromised device or malicious browser extensions.