JWT Decoder
Decode the header and payload of a JSON Web Token and inspect its claims.
Decoded locally. The signature is never verified, so no secret is required.
About JWT Decoder
A JSON Web Token is three base64url-encoded segments joined by dots: a header describing the algorithm, a payload of claims, and a signature. The first two segments are encoded, not encrypted, so anyone holding the token can read them.
This decoder splits the token, decodes both segments and highlights the registered claims - issuer, subject, audience, expiry - converting timestamps into local dates and flagging tokens that have already expired.
Frequently asked questions
Does this verify the signature?
No. Verification requires the signing secret or public key, and you should never paste a production secret into a web page. This tool decodes only.
Is my token sent to a server?
Never. Decoding is base64url plus a JSON parse, both of which run locally in your browser.
Why is my expiry shown as a date?
The exp, iat and nbf claims are NumericDate values - seconds since the Unix epoch - so they are rendered as readable dates for convenience.