JWT Decoder
Decode a JWT's header and payload to readable JSON, locally in your browser. Decoding only - this does not verify signatures.
Paste a JSON Web Token and instantly see its decoded header and payload as readable JSON - algorithm, token type, expiry, subject, and any custom claims. Useful for debugging an auth flow, checking when a token expires, or inspecting what claims a third-party service issued. This is decoding only: the signature is not verified, so it doesn't confirm the token is authentic or was issued by the expected party. Everything happens locally in your browser.
Loading tool
How it works
- 01
Paste a JWT.
- 02
View the decoded header and payload as JSON.
- 03
Copy the fields you need.
Details
- Category
- Developer & data
- Runs
- In your browser
- Files uploaded
- No
- Cost per run
- Free
- Sign-in
- Not required
- Works offline
- Yes, once loaded
Last updated 2026-08-03
Common questions
Does this verify the signature?
No - it only base64-decodes the header and payload. It cannot confirm the token wasn't tampered with or forged.
Can I decode any JWT, or only ones I created?
Any well-formed JWT can be decoded, since the header and payload are just base64-encoded JSON, not encrypted.
What does the 'exp' claim mean?
It's the Unix timestamp when the token expires. Use the Unix Timestamp Converter to read it as a date.
Is my token uploaded anywhere?
No - decoding happens entirely in your browser.