Tool Factory

JWT Decoder

Decode a JWT token in your browser — header and payload as readable JSON, no signature check, nothing uploaded.

  • Header + payload
  • Base64url only
  • Not verification

Decoding is not verification. This JWT decoder reads the header and payload only. Signatures are not checked, and the token never leaves your browser.

Paste a JWT token to decode the header and claims as readable JSON.

A JWT decoder turns a compact JSON Web Token into the JSON objects inside it. Searchers also call this a JWT token decoder. Paste the string, and this page splits header, payload, and the unused signature segment, then base64url-decodes the first two parts.

Claims stay as JSON so you can read sub, iss, aud, and the rest. Time fields iat, exp, and nbf also show as UTC timestamps. Decoding does not prove who signed the token or whether it is still valid.

Everything runs locally with no network call. Use this when you need to inspect a token you already have — not to authenticate a user. Need to pretty-print a query? Open the SQL formatter. Need identifiers for a test fixture? Open the UUID generator. For campaign URLs, use the UTM builder. For crawl rules, try the robots.txt builder. More utilities live on the Developer hub.

How to use the JWT decoder

  1. Paste a JWT into the box. A Bearer prefix is optional.
  2. Read the header JSON (algorithm and type) and the payload claims.
  3. Scan formatted exp, iat, and nbf values if those claims are present.
  4. Copy the JSON if you need it in a ticket or local script.
  5. Do not treat a successful decode as proof the token is authentic.

Frequently asked questions

What is a JWT decoder?

A JWT decoder reads a JSON Web Token and shows the header and payload as JSON. This JWT token decoder splits the three base64url segments, then pretty-prints claims such as sub, iss, exp, and iat in your browser.

Does this JWT decoder verify the signature?

No. Decoding is not verification. The page never checks HMAC, RSA, or any other signature, and it does not fetch keys. Treat the claims as unsigned data until your own app verifies the token.

Is my JWT token sent to a server?

No. Paste stays in this tab. Header, payload, and signature bytes are decoded with base64url in your browser. We do not log, store, or upload tokens.

Can a JWT token decoder read an expired token?

Yes. Expiration (exp) is just another claim. This decoder still shows expired or not-yet-valid tokens and formats exp, iat, and nbf as UTC timestamps. Validity is a verification step, not a decode step.

What JWT formats does this decoder accept?

Unencrypted JWS tokens with two or three parts (header.payload or header.payload.signature). An optional Bearer prefix and extra whitespace are stripped. Encrypted JWTs (JWE, five parts) are not decoded.

Other tools