JWT decoder
Paste a JSON Web Token to read its header and payload without sending it to any server.
🔒 Everything runs in your browser. Nothing you choose or type is uploaded. How to verify
How to use it
- Paste your JWT.
- Select Run.
- Read the header, payload and issue time.
Handy for
Debugging login problems and checking token expiry times.
Good to know
A JWT has three parts separated by dots. The header and payload are only encoded, not encrypted, so anyone holding the token can read them.
Privacy: where the work happens
Everything you enter or choose is processed by JavaScript in your browser and never sent anywhere. Only the page code, and any library this tool needs, is downloaded from cdnjs or jsDelivr.
Questions
Does it verify the signature?
No. It only decodes the readable parts. Verifying needs the secret or public key.
Is it safe to paste a real token?
It is decoded in your browser, but a token can grant access, so use test tokens when you can.