JWT Decoder
Decode a JWT's header and payload to readable JSON, locally in your browser. Decoding only - this does not verify signatures.
Paste a JSON Web Token and instantly see its decoded header and payload as readable JSON - algorithm, token type, expiry, subject, and any custom claims. Useful for debugging an auth flow, checking when a token expires, or inspecting what claims a third-party service issued. This is decoding only: the signature is not verified, so it doesn't confirm the token is authentic or was issued by the expected party. Everything happens locally in your browser.
Runs on your device. This tool processes your file inside this browser tab. Nothing is uploaded, so it also works offline once the page has loaded, and closing the tab discards the file from memory.
Loading tool
How it works
- 01
Paste a JWT.
- 02
View the decoded header and payload as JSON.
- 03
Copy the fields you need.
Details
- Category
- Developer & data
- Runs
- In your browser
- Files uploaded
- No
- Cost per run
- Free
- Sign-in
- Not required
- Works offline
- Yes, once loaded
Last updated 2026-08-12
Common questions
Does this verify the signature?
No - it only base64-decodes the header and payload. It cannot confirm the token wasn't tampered with or forged.
Can I decode any JWT, or only ones I created?
Any well-formed JWT can be decoded, since the header and payload are just base64-encoded JSON, not encrypted.
What does the 'exp' claim mean?
It's the Unix timestamp when the token expires. Use the Unix Timestamp Converter to read it as a date.
Is my token uploaded anywhere?
No - decoding happens entirely in your browser.
Use this from your code
This tool is also a REST endpoint, so you can run it in a pipeline instead of by hand. It is free and needs no API key. See the API reference for every parameter.
curl -X POST https://fileoven.com/api/v1/tools/jwt-decoder \
-H "Content-Type: application/json" \
-d '{"token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig"}'