JWT decoder

Free · no sign-up

Decode a JSON Web Token's header and payload — locally, nothing is sent anywhere.

Token

The decoded token will appear here.

Runs entirely in your browser — your data never leaves your device and nothing is stored. No sign-up.

📖GuidesWhat is a JWT? A plain-English guide→

Paste a JSON Web Token and instantly see what's inside. This free JWT decoder splits the token and decodes its header and payload from Base64URL into readable JSON, and highlights standard claims like issued-at and expiry in your local time. Decoding is done entirely in your browser — the token never leaves your device.

✓Header and payload as readable, formatted JSON
✓Human-readable issued-at, not-before and expiry
✓Expired / valid badge at a glance
✓Runs locally — the token is never uploaded
✓Copy the header or payload in one click

Who it's for

Developers debugging authentication
Inspecting claims in an API token
Checking a token's expiry
Learning how JWTs are structured

How it works

1Paste your JWT (the eyJ… string).
2Read the decoded header and payload.
3Check the expiry and other claims.
4Copy what you need.

Frequently asked questions

Does this verify the signature?+

No. It decodes the header and payload so you can read them, but it does not verify the signature — that requires the secret or public key, which should never be pasted into a website.

Is my token sent anywhere?+

No. The token is decoded entirely in your browser; nothing is uploaded, logged or stored.

What's inside a JWT?+

Three Base64URL parts separated by dots: a header (algorithm and type), a payload (claims like sub, iat, exp), and a signature. This tool shows all three.

Why is my token 'expired'?+

If the payload has an exp claim in the past, the token is expired. The decoder converts exp to your local time and flags it.