🔑
JWT Decoder
Paste a JWT to instantly decode its Base64URL-encoded header and payload and read human-friendly issued-at and expiry times. Decoding is done locally; the token is never sent anywhere. Note this tool inspects tokens — it does not verify signatures.
Encoded token
🔒 Decoding happens entirely in your browser. This tool does not verify the signature — never trust a token you haven't cryptographically verified server-side.
Header
Payload
🔒 This tool runs entirely in your browser. Your data is never uploaded.
Frequently asked questions
Does this verify the token signature?＋
No. It decodes and displays the contents only. Signature verification requires the secret or public key and should be done server-side.
Is it safe to paste a real token?＋
Decoding happens entirely in your browser and nothing is transmitted. That said, treat production tokens as sensitive credentials.