JWT Decoder
Decode a JSON Web Token to inspect its header, claims, and expiration.
How to use
- Paste your JWT into the input box.
- The header and payload are decoded and displayed as JSON.
- Check the expiration banner to see if the token is still valid.
- Copy any section with its Copy button.
About this tool
ShowHide
Paste a JSON Web Token and instantly read its decoded header and payload as formatted JSON, along with the raw signature. Registered time claims are pulled out and shown in your own local time: exp as a validity line that turns red once it has passed, plus iat and nbf when present. Two things are worth being clear about. This tool decodes, it does not verify — the signature is displayed but never checked, so a token that has been tampered with still renders normally. And decoding is not decryption: a standard JWT is signed, not encrypted, so its claims were always readable by anyone holding the token. Everything happens locally; your token is never sent to a server.
Frequently asked questions
Does this verify the signature?
No. JWT verification needs the issuer's secret or public key. This tool only decodes the base64url payload so you can inspect the claims.
Is my token sent anywhere?
No. Decoding runs entirely in your browser; nothing leaves your device.
What formats are supported?
Compact JWS / JWT tokens with three dot-separated parts (header.payload.signature).
Why does it say invalid?
Either the token doesn't have three parts or the header/payload aren't valid base64url-encoded JSON.
The token decodes fine but my API still rejects it.
Decoding only proves the token is well-formed. Check exp against the server's clock rather than yours, confirm the aud and iss claims match what the API expects, and consider whether the signing key has rotated — none of that is visible here.
Is it safe to paste a token here?
Nothing is transmitted; decoding happens in the page. But a JWT is a bearer credential — whoever holds it can use it until it expires — so if the token is still live, treat one you have pasted anywhere as a token worth rotating.
Related tools
JWT Generator
Build and sign HS256 / HS384 / HS512 JWTs from a header and payload — pairs with the JWT Decoder.
Developer
Protobuf Decoder (no .proto needed)
Paste base64 or hex protobuf bytes and read the fields — numbers, wire types, nested messages, strings and packed arrays — without a schema.
Developer
PWA Manifest Builder
Build a valid manifest.json for a Progressive Web App — name, icons, theme color, display mode, scope — with the matching HTML <link> tags.
Developer
JWK to PEM Converter (and back)
Turn a JWK or a whole JWKS into PEM public keys and back, with the RFC 7638 thumbprint for each — computed in your browser.
Developer
HMAC Generator (SHA-1 / 256 / 384 / 512)
Compute HMAC signatures with Web Crypto — sign webhook payloads, verify API requests, hex or base64 output.
Developer
BSON Decoder & Extended JSON Viewer
Decode a MongoDB BSON file in your browser: every element type with its type byte, exact int64 and decimal128, and canonical or relaxed Extended JSON.
Developer