JWT Decoder
Paste a JSON Web Token and read its header and payload instantly. Decodes only, in your browser, with no verification.
Paste your JWT below:
How to decode a JWT
- Copy the full JWT string, including both dots.
- Paste it into the input box above.
- Click Decode to read the header and payload.
- Review the claims and any readable dates.
FAQs
What is a JWT?
A JSON Web Token is a compact, URL-safe string made of three dot-separated parts: a header, a payload, and a signature. The header and payload are just Base64URL-encoded JSON.
Does this tool verify the token?
No. It only decodes the header and payload so you can read them. Verifying authenticity requires a secret or public key, which this tool never asks for.
Is my token sent to a server?
No. Decoding happens entirely in your browser, so your token never leaves your device. Be careful not to paste tokens into untrusted sites anyway.
What do exp, iat and nbf mean?
exp is the expiry time, iat is the time the token was issued, and nbf is the time before which it is not valid. All three are Unix timestamps.
Related Tools
Why decode a JWT locally?
A JWT looks like opaque text, but its header and payload are just Base64URL-encoded JSON. Decoding them locally lets you inspect claims while keeping the token on your device.
- Check which claims an access token actually contains.
- See a token's expiry time before you build around it.
- Debug an authentication flow without leaking the token.
Tips and Limits
A JWT must have exactly three dot-separated parts. This tool decodes but does not verify tokens, so never treat a decoded token as proof it is authentic. Everything runs locally in your browser.