JWT Decoder
Paste a JWT and instantly read its decoded header and payload as formatted JSON. See when the token was issued, when it expires, and the raw signature. Decoding happens locally — your token is never sent to a server. Note that this tool does not verify the signature.
How to use
- Paste your JWT into the input box.
- The header and payload are decoded and displayed as JSON.
- Check the expiration banner to see if the token is still valid.
- Copy any section with its Copy button.
Frequently asked questions
- Does this verify the signature?
- No. JWT verification needs the issuer's secret or public key. This tool only decodes the base64url payload so you can inspect the claims.
- Is my token sent anywhere?
- No. Decoding runs entirely in your browser; nothing leaves your device.
- What formats are supported?
- Compact JWS / JWT tokens with three dot-separated parts (header.payload.signature).
- Why does it say invalid?
- Either the token doesn't have three parts or the header/payload aren't valid base64url-encoded JSON.
Related tools
JWT Generator
Build and sign HS256 / HS384 / HS512 JWTs from a header and payload — pairs with the JWT Decoder.
Protobuf Decoder (no .proto needed)
Paste base64 or hex protobuf bytes and read the fields — numbers, wire types, nested messages, strings and packed arrays — without a schema.
PWA Manifest Builder
Build a valid `manifest.json` for a Progressive Web App — name, icons, theme color, display mode, scope, orientation — with the matching HTML `<link>` and Apple meta tags.
HTTP Cookie Parser
Paste a `Cookie:` request header or a `Set-Cookie:` response header and see each cookie's name, value, attributes, and warnings.
MessagePack Decoder
Paste base64 or hex MessagePack bytes and read the values — types, nested maps, binary blobs and timestamps — decoded in your browser.
JWK to PEM Converter (and back)
Turn a JWK or a whole JWKS into PEM public keys and back, with the RFC 7638 thumbprint for each — computed in your browser.