JWT Decoder & Token Inspector
Paste a JSON Web Token and this decodes its header and payload locally, so the token never touches a server. It pretty-prints the JSON, summarizes the registered claims, and shows issued-at, not-before and expiry in UTC, local and relative time. Decoding isn't verification, though — it won't check the signature or prove the token is valid.
- 100% free
- Private & safe
- Runs in your browser
Why use JWT Decoder?
JWT Decoder runs locally using your browser's built-in cryptography, so passwords, keys and hashes are never uploaded or logged.
- Runs instantly in your browser — nothing to install, nothing uploaded.
- Completely free, with no account, no watermarks and no usage limits.
- Structure: header.payload.signature (Base64URL)
- Paste a JWT (three dot-separated segments) into the input.
- Works on any device — desktop, tablet and phone — and is fully keyboard accessible.
How to use JWT Decoder
- Paste a JWT (three dot-separated segments) into the input.
- The header and payload are decoded and pretty-printed automatically.
- Review registered claims (iss, sub, aud, jti) and timing (iat, nbf, exp).
- Copy the header, payload, or everything. The signature is shown as opaque text.
Examples
- Inspecting an access token's expiry to see whether it has lapsed.
- Reading the 'sub' and 'iss' claims of a demo token.
Supported formats & limits
- Structure: header.payload.signature (Base64URL)
Limitations
- Decoding does NOT verify the signature — it cannot prove the token is authentic or untampered.
- It never contacts a server, loads URLs found in claims, or stores your token.
- Extremely large tokens are rejected to protect performance.
Frequently asked questions
Does this verify the token?
No. Verification requires the signing key. This tool only decodes the header and payload so you can read them.
Is my token sent anywhere?
No. Decoding happens locally in your browser and the token is never uploaded or stored.
Should I paste production tokens?
Be careful. JWTs can contain sensitive data — only paste tokens into tools you trust, and prefer non-production tokens.