Processed locally — your file never leaves your device
JWT Decoder
Decode a JSON Web Token's header and payload in your browser, with expiry and issued-at times shown as readable dates.
Decoded, not verified.A JWT’s payload is only base64 — anyone holding the token can read it, and anyone can craft one. Nothing here proves the token is genuine, because checking that needs the signing key, which this page deliberately never asks for.
The token is decoded in this tab and never sent anywhere — which matters more here than for most tools, since a JWT is usually a live credential.
How it works
- Paste a JSON Web Token — a leading "Bearer " is fine.
- The header and payload are decoded as you type.
- Read the claims, with expiry and issued-at shown as real dates.
Frequently asked questions
- Is my token sent anywhere?
- No. Decoding happens in this tab and nothing is transmitted. This is the reason to prefer a local decoder: a JWT is usually a live credential, and pasting one into a page that sends it to a server hands over working access for as long as the token remains valid.
- Does it verify the signature?
- No, and that's deliberate. Verifying requires the signing secret or the issuer's public key, and a web page asking you to paste a signing secret is a habit worth not building — whatever it promises to do with it. This decodes; it never claims a token is genuine.
- Is it safe that anyone can read my token's payload?
- It's how JWTs work, and worth understanding: the payload is base64, not encryption. Anyone holding the token can read every claim in it. That's why tokens shouldn't carry secrets, and why they're signed — the signature stops them being altered, not read.
- Can I paste it straight from an Authorization header?
- Yes. A leading "Bearer " is stripped automatically, so you can paste directly from a header or a curl command without editing it first.
- How do I read the exp and iat claims?
- They're shown as readable UTC dates alongside their raw values, and exp is marked expired or valid against your device's current time. A token whose nbf is still in the future is marked as not valid yet.
- What does an algorithm of "none" mean?
- It means the token carries no signature at all. Any system accepting such a token accepts anything anyone writes, so it's flagged here — it's a well-known vulnerability rather than a normal configuration.