JWT Decoder
Decode a JWT header and payload in your browser. Inspect claims without verifying the signature. Free JWT decoder, nothing uploaded.
Processed locally in your browser.
How to use this jwt decoder
Paste a token in the form header.payload.signature. The decoder Base64URL-decodes the first two parts and pretty-prints JSON claims.
This does not verify signatures or trust the token. Use it to read exp, sub, and similar claims while debugging. Never paste a production secret into a webpage you do not control—this page still keeps the token on your device.
Example
A JWT has three dot-separated parts. The payload is JSON such as {"sub":"123","exp":1735689600}.
Related tools
More developer tools
- Unix Timestamp Converter — Convert Unix time (epoch seconds or milliseconds) to local date, UTC, and ISO 8601. Free timestamp and epoch converter.
- Regex Tester — Test JavaScript regular expressions against sample text. See matches, indexes, and capture groups instantly in your browser.
Frequently asked questions
Does this verify JWT signatures?
No. It only decodes. Anyone can decode a JWT; verification needs the signing key and belongs on a trusted server.
Is it safe to paste a JWT here?
Decoding runs locally. Avoid pasting live access tokens into third-party sites in general. This tool does not send the token to our servers to decode it.
Why is the payload unreadable?
Some tokens encrypt the payload (JWE). This decoder is for signed JWTs (JWS), not encrypted ones.
Where is exp displayed?
If the payload is JSON, you will see exp as a Unix timestamp. Convert it with the timestamp converter.
Last reviewed 2026-08-19. Results stay on your device unless you copy them elsewhere.