JWT Decoder
Decode a JSON Web Token to read its header and payload, and check expiry.
Runs in your browser using Base64url + JSON.parse — nothing is uploaded
How to use it
- Paste the token.
- The header and payload are decoded immediately, with timestamps shown in readable form.
Questions
Does this verify the signature?
No, and it deliberately does not pretend to. Verifying requires the secret or public key, which should never be pasted into a web page. This tool decodes the readable parts only.
Is it safe to paste a real token here?
The decoding happens entirely in your browser and the token is never transmitted. That said, a live token grants access, so treat it as a password: prefer an expired or test token, and never paste one into a tool you have not verified.
Why is the payload readable without a key?
A JWT is signed, not encrypted. Anyone holding the token can read its contents. Never put secrets in a JWT payload.