JWT Decoder
/jwt-decoderDecode JWT tokens to inspect header, payload, and expiration. No signature verification, just quick decoding.
JWTs hide their contents in base64url encoding, which makes debugging sessions and access tokens tedious by hand. This decoder unpacks the header and payload instantly and shows the expiration time in a readable format. It is a quick inspection tool for developers working with authentication flows. Tokens are decoded locally and never transmitted.
- 01Upload
- 02Configure
- 03Run
- 04Download
Loading tool...
FAQ
Frequently asked questions
Everything you need to know about jwt decoder.
Does this verify JWT signatures?
No. The tool decodes the header and payload for inspection only. Signature verification requires the secret key, which this tool never has.
Is my token safe to paste?
JWTs are base64-encoded, not encrypted. Anyone holding a token can read its payload, so only paste tokens that are already public or expired.
Why did I get an Invalid JWT format error?
The input must contain at least header.payload segments separated by dots, using valid base64url characters. Check for missing dots or corrupted text.
What does the expiry notice mean?
If the payload contains an exp claim, the tool shows the exact expiry time converted to your local timezone and how many days remain.
Can I copy the decoded sections?
Yes. The header and payload each render as pretty-printed JSON with their own copy button, so you can reuse individual parts of the token.
Is the decoding done locally?
Yes. Decoding uses base64url conversion and atob entirely in your browser, so the token is never transmitted.
Related tools
same category · same privacy