JWT Decoder
Paste a JSON Web Token to inspect its header, payload, expiry and other registered claims. The decoder uses Base64URL locally in your browser and clearly separates decoding from cryptographic signature verification.
🔒 100% private — files never leave your browser
Decoding is not signature verification. Treat tokens as sensitive and never paste a live production token into a third-party service.
How to use the JWT Decoder
- 1 Paste the three-part JWT into the input box.
- 2 Decode it to inspect the header, payload and readable claim dates.
- 3 Use the result for debugging, but never treat decoding as signature verification.
Frequently asked questions
Does this JWT decoder verify the signature?
No. It only decodes the Base64URL header and payload. Signature verification needs the correct key and algorithm and is intentionally outside this local inspection tool.
Is my token uploaded?
No. The token is decoded in your browser and is not sent to a server. Still avoid pasting live production credentials into any online tool.
Which JWT claims are shown as dates?
Numeric exp, iat and nbf claims are also displayed as local-readable ISO timestamps. The complete original JSON remains visible in the payload section.