JWT Decoder
Decode JSON Web Tokens
Header
Payload
Signature is not verified. That requires the secret or public key and should be done on your server.
About the JWT Decoder
JSON Web Tokens carry claims such as the user ID and expiry time in a signed, Base64URL-encoded string. Paste a token to see its header and payload as formatted JSON, with dates such as exp, iat and nbf converted to readable times.
- Paste the JWT.
- Read the decoded header and payload.
- Check the expiry status and the claim times.
Frequently asked
Is it safe to paste my token here?
Decoding happens entirely in your browser and the token is never sent anywhere. Still, treat production tokens like passwords.
Does this verify the signature?
No. It only decodes the token. Signature verification needs the secret or public key and should be done on your server.
Why can anyone read a JWT?
A standard JWT is signed, not encrypted. The signature stops tampering, but the payload is only Base64URL-encoded, so don't put secrets in it.
Is what I type sent to a server?
No. The tool runs entirely in your browser and there's no server behind it, so what you type never leaves your device and nothing is stored. You can check: it keeps working if you go offline after the page has loaded.
More from the Developer drawer
Other tools kept in this drawer, plus a few favourites from the bench.