🎫 JWT Decoder
Paste a JWT and read its header and payload instantly — with the expiry (exp) checked — all locally, which is the only safe way to inspect tokens.
decoded locally — signature NOT verified (that requires the secret/key)
How the jwt decoder works
A JWT is three Base64URL segments separated by dots: header (algorithm), payload (claims) and signature. The first two are just encoded JSON — decoding them requires no key, which this tool does locally, pretty-printing both and evaluating the exp claim against the current time. The signature is NOT verified: that requires the signing secret or public key and belongs on your server, not in a web page.
The privacy point is not optional here: a JWT often IS a live credential. Pasting one into a random website’s "JWT decoder" hands your session to that server. This decoder runs entirely in your browser — verify with the network tab, or go offline first.
Frequently asked questions
Does decoding a JWT require the secret?
No — header and payload are Base64URL-encoded JSON, readable by anyone. The secret is only needed to VERIFY the signature (i.e., prove the token wasn't tampered with), which this tool intentionally does not do.
Why does it say "signature NOT verified"?
Honesty: without your signing key, no client-side tool can check authenticity. Decoding shows what the token claims; verification (server-side, with the key) proves the claims are genuine.
What are iat, exp and sub?
Registered claims: iat = issued-at, exp = expiry, sub = subject (user id) — all Unix timestamps where relevant. The tool converts exp to a date and flags expired tokens.
Is it safe to paste a production token here?
Here, yes — nothing is transmitted (the page works offline). As a rule though, treat live tokens like passwords: prefer expired or test tokens when debugging, wherever the tool runs.
Why does my token fail to decode?
Check for the three-part dot structure and complete copying — truncated middles are the usual culprit. Opaque (non-JWT) session tokens also exist and won't decode.