JWT Decoder
Decode a JWT online for free, entirely in your browser. Read the header and payload — this does not verify the token's signature.
Decoding a JWT does not verify its signature. Anyone can create a token with any content — this tool reads what's inside, it doesn't confirm the token is authentic or was issued by who it claims.
Your files are processed locally in your browser and are not uploaded to our servers.
How to use JWT Decoder
- 1
Paste a JWT (three dot-separated parts) into the box.
- 2
Click "Decode."
- 3
Review the decoded header and payload, and the expiration/issued-at dates if present.
Common uses
- Reading what claims are actually inside a JWT during API debugging
- Checking when a token expires without writing a script
- Inspecting a token's header to see what signing algorithm it declares
Supported formats and limitations
Accepts text, up to one file at a time.
- This decodes the token's contents — it does not verify the signature. A token with a syntactically valid structure decodes successfully whether or not it's authentic, expired-but-well-formed, or entirely forged.
- A malformed token (wrong number of parts, invalid Base64URL segments) is rejected with a clear error rather than a partial or misleading result.
Frequently asked questions
No. Decoding a JWT does not verify its signature — anyone can construct a token with any content. This tool only reads what's inside; it never claims the token is genuine.
No — the token is never sent to a server, never logged to the console, and never saved. It only exists in this page's memory while you're using it.
If the token has an `exp` claim, it's shown as a human-readable UTC date, along with whether that date has already passed — but this is just reading the claim, not proof the token was ever valid to begin with.
You'll see "Invalid JWT format" rather than a broken or partial decode.
No — signature verification requires the issuer's signing key, which this tool never has access to and never asks for.