JWT decoder

Header, payload, expiry.

JWT token (or “Authorization: Bearer …” header)

Signature not verified. This tool decodes, it does not validate: never trust a token based on its contents alone.

Paste a token to see its contents — nothing leaves your browser.

100% local — your data never leaves your browser
Free, no usage limits
No sign-up, no account

Decoding happens entirely in your browser

A JWT is made of three base64url-encoded segments: the header, the payload and the signature. The tool decodes the first two in your browser and shows the indented JSON, the standard claims (iss, sub, aud, iat, nbf, exp) with readable dates, and the token’s expiry status. Nothing leaves your browser: no upload, no storage.

Dates are shown in your browser’s time zone. The “Bearer” prefix and line breaks from a terminal paste are ignored.

The signature is not verified

Decoding is not validating: anyone can forge a token with arbitrary contents. Only cryptographic verification of the signature — with the secret or the public key, server-side — proves authenticity. This tool is for reading and debugging, never for making trust decisions.

Encrypted tokens (JWE, five segments) are not supported.