JWT decoder
Paste a token to see its header, claims and expiry time. Decoding happens in this tab, so it's fine for debugging real sessions.
Runs entirely in your browser — nothing you enter is sent to our servers.
How it works
A JWT is three Base64URL parts joined by dots: header, payload and signature. The first two are plain JSON — anyone holding the token can read them, which is why you shouldn't put secrets in claims. This tool decodes both parts and turns iat, nbf and exp into dates in your time zone. It doesn't verify the signature: that needs the issuer's secret or public key.
FAQ
Is the token sent to a server?
No. Decoding is done in JavaScript right here; you can paste a token with the network disconnected.
Why can anyone read my JWT?
The payload is encoded, not encrypted. The signature only proves that nobody changed it. If claims must stay secret, use JWE or keep the data server-side.
Related tools
Put it to use on your own server: KVM VPS from $3/month, root access, crypto payments.
VPS plans