Decode a JWT token
Decode JWT header and payload in your browser — base64url, exp status and algorithm shown live. Nothing is uploaded and signatures are never verified.
Decoding is not verification — a valid-looking signature says nothing about authenticity. Never paste production tokens anywhere you don’t trust.
Paste a JSON Web Token and its header and payload decode instantly: the algorithm, the claims, and whether the exp (expiry) timestamp has passed. Decoding runs entirely in your browser — the token is parsed in memory and never transmitted anywhere.
One thing this tool deliberately does not do: verify the signature. Verification requires the secret or public key and is the job of your backend. A decoded JWT proves nothing about authenticity — anyone can mint a token with any claims — which is why the decoder states it plainly instead of pretending.
Use it to debug auth flows: check which claims your provider actually issued, confirm the expiry math, or see why a middleware rejected a token. The payload renders exactly as stored, no field filtering.
Frequently asked questions
- Is it safe to paste my JWT here?
- The token never leaves your browser — decoding is native base64url plus JSON.parse in your tab. Still, decoded tokens are sensitive: don’t paste production tokens into tools you don’t control either.
- Can this tool verify the signature?
- No, on purpose. Verification needs the signing key and belongs in your backend. This tool decodes claims so you can inspect them.
- What does the exp claim mean?
- The expiry time in seconds since 1970. The badge shows whether it has already passed, in your browser’s clock — if your machine’s time is wrong, the badge is wrong.