Paste a JWT to see its header, payload, and signature broken down into readable JSON. Decoding happens locally; your token never leaves your device.
Did this tool save you some time? A quick testimonial helps a lot.
Paste a JWT to see its header, payload, and signature broken down into readable JSON. Decoding happens locally; your token never leaves your device. Common questions — like does this tool verify the jwt signature — are answered in the FAQ below.
Add your input to the workspace above, review the result, then copy or download it when it's ready. No account or installation is required.
JWT Decoder runs in your browser, so the information you enter stays on your device instead of being uploaded to a server.
A few worked examples so you know what to expect before you paste in your own input.
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}Input
A JWT whose payload includes "exp": 1735689600
Output
Payload shows exp: 1735689600 — compare it against the current time to see whether the token has expired.
Input
A JWT whose payload was edited to add "role": "admin"
Output
Decoding only reads the payload — it does not verify the signature, so an edited token still decodes. Signature verification (done server-side, with the secret) is what would actually reject it.
Decoding, inspecting claims, checking expiry, and validating structure — the JWT tasks that come up daily and how to handle them without a library.
Pasting a token into a random website is a bad habit. Here's what actually happens when you decode a JWT, and why it should never leave your device.
Base64 encoding explained simply: what it actually does, why it's not secure, and when to actually use it vs when you shouldn't.
Related Tools
Encode or decode Base64 strings.
Convert between Unix timestamps and human-readable dates.
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes.
Generate HMAC signatures with SHA-256/SHA-512.
Decode X.509 certificates into readable fields.