JWT Decoder
Paste a JSON Web Token to decode its header, payload, and signature. This tool decodes locally in your browser — it does not verify signatures.
Sample Tokens
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes the token to show you the header, payload, and signature — it does not verify that the signature is valid. Verifying a signature requires your secret or public key, which this tool never asks for.
Is it safe to paste a real token here?
Decoding happens entirely in your browser; the token is never uploaded or sent to any server. Still, treat live tokens as secrets — anyone who reads a JWT payload can see its claims, since the payload is only Base64-encoded, not encrypted.
What do the Issued and Expires fields mean?
They read the iat (issued-at) and exp (expiration) claims from the payload and show human-readable dates, plus a status badge telling you whether the token is currently active or expired.
Can a decoded token be expired but still decode fine?
Yes. Decoding works regardless of expiry — an expired token still shows its full contents and is simply flagged as expired in the status bar.
Related tools
- Base64 Encode / Decode Convert text and files to Base64 or decode Base64 back to text.
- URL Encode / Decode Percent-encode strings for URLs or decode them back to readable text.
- HTML Encode / Decode Escape HTML entities or convert encoded entities back to symbols.
- UUID Generator Generate v4 UUIDs one at a time or in bulk up to 50 at once.