JWT decoder
Decode a compact JWT and read the header, payload, and common time claims. Decoded only — signature not verified. A readable token is not authentic, trustworthy, or authorized.
It runs in your browser. What you enter stays on this device.
How to use it
- 1Paste a compact JWT. It stays in this box and is not added to the page address.
- 2Choose Decode.
- 3Read the header, payload, and any iss, sub, aud, iat, nbf, or exp claims.
- 4Copy the header or payload, or choose Clear to remove the token from the form.
When it helps
- Inspect the claims in a token while debugging a request.
- See whether exp is in the past or future on this device's clock.
- Check that a token has the expected issuer and subject before a separate system verifies it.
Good to know
- Decoded only — signature not verified. This page cannot tell you the token is authentic, trustworthy, or authorized.
- The header and payload are Base64URL JSON. The signature bytes are not checked.
- iat, nbf, and exp are NumericDate values: seconds since 1970-01-01 UTC, as defined by the JWT specification. A large number is still seconds. It is not read as milliseconds.
- The token is not stored in local storage, the page address, or browser history.
- The input stays under 100 KB.
Questions
Does decoding prove the token is valid?
No. Anyone can create a token that decodes. This tool never verifies the signature, so do not treat the result as authentication or authorization.
Is the token uploaded?
No. Decoding runs in this browser. The token is not sent to a server or included in analytics.
Related tools
JSON formatter JSON formatter
Check JSON, then format or minify it in the browser.
Developer
Base64 encoder Base64 encoder
Encode or decode Base64 in the browser, including Unicode text.
Developer