JWT Decoder
Paste a JSON Web Token to read its header and payload, see when it expires, and check the claims — without sending it anywhere.
A leading "Bearer " is ignored, so you can paste an Authorization header
Runs entirely in your browser — nothing you paste is uploaded or stored.
About jwt decoder
A JWT is three Base64url segments separated by dots: a header saying how it was signed, a payload of claims, and a signature. The first two are not encrypted — anyone holding the token can read them, which is exactly what this tool does.
Decoding is most useful for answering practical questions: has this token expired, which user does it identify, what scopes does it carry, and which key signed it. The expiry and issued-at timestamps are shown as real dates rather than raw epoch numbers.
Good to know
- This decodes, it does not verify. Confirming a signature requires the issuer's secret or public key, and a decoder that asked you to paste your signing secret into a web page would be a bad idea.
- A JWT payload is readable by anyone who has the token. Never put anything secret in it — the signature protects it from being changed, not from being read.
- Decoding happens in your browser. The token is never transmitted, which matters because a JWT is a live credential.