JWT Decoder
Decode a JSON Web Token to read its header and payload, and see whether it has expired.
How to use this tool
- Paste or type your text into the box above.
- The result updates as you change the input — there is nothing to submit and nothing to wait for.
- Read the figures in the result panel, or copy the converted text.
- Use Copy or Download if you need the output elsewhere. Nothing was uploaded at any point.
Decoding is not verification. A JWT’s payload is base64url-encoded, not encrypted, so anyone holding the token can read it — which is exactly why you should never put a secret in one. Checking the signature needs the signing key and is deliberately not done here.
JWT Decoder — the specification
| Reads | Header and payload, formatted as JSON |
|---|---|
| Reports | Algorithm, type, issued-at, expiry, subject |
| Expiry | Compared against your device clock |
| Signature | Not verified — that requires the key |
How it works
This tool runs entirely in your browser. There is no server involved, which means nothing you type or upload is transmitted, stored, or logged — and there are no usage limits, because there is nothing for us to ration.
You can confirm it yourself: open your browser's developer tools, select the Network tab, and use the tool. No request is made.
Who needs JWT Decoder
Debugging why an API rejected a token, checking what claims a login actually returned, or confirming an expiry time.
JWT Decoder — frequently asked questions
Does this verify the signature?
No, and no browser tool should ask you to paste a signing key to find out. This reads the parts of the token that are already public. Verification belongs on your server.
Is it safe to paste a token here?
The decoding happens in your browser and nothing is transmitted. That said, a live token is a credential: treat pasting one anywhere with the same care you would a password, and prefer an expired or test token.
Why can I read the payload without any key?
Because JWTs are signed, not encrypted. The signature proves the contents were not altered; it does not hide them. Never put anything confidential in a JWT payload.
Does this work offline?
Yes. Once the page has loaded you can disconnect from the internet and it keeps working, because all the processing happens in your browser. That is also the simplest way to confirm nothing is being sent anywhere.
Is there a limit on how much I can paste in?
Nothing we impose. The practical limit is your device’s memory, since the work happens locally. Very large inputs get slower rather than being refused.
Can I use this on a phone?
Yes. The layout adapts to a small screen and everything works the same way.
Related tools
From other categories
Background reading: Text and Developer Tools That Never Upload Your Data
Your file never leaves your device. Open your browser's Network tab while you use this page and you will see no upload — how that works.
Disclaimer. Published requirements change without notice. Confirm against the official source before you submit. Full disclaimer.