JWT Decoder — Read a Token Without Uploading It
See what is inside a token — without handing it to anyone.
Runs on your device What you paste is processed by your own browser. It is never sent to a server, and it is not stored anywhere after you leave the page.
Short answer
A JSON Web Token can be decoded for free in a web browser without transmitting it. The token's three dot-separated sections are split, the header and payload are Base64url-decoded and formatted as JSON, and the registered time claims — iat, nbf and exp — are restated as dates, with the expiry marked as passed or still valid. The signature is shown but not verified, because verification requires the signing key and no key should be pasted into a web page.
At a glance
| Accepts | A JWT (header.payload.signature) |
|---|---|
| Produces | Formatted JSON, with dates for the time claims |
| Processing | In your browser |
| Price | Free, no limits |
| Account | Not required |
A JWT is not encrypted. Its header and payload are Base64url-encoded JSON that anyone holding the token can read, and the signature only proves the token was issued by whoever holds the key — it does not hide the contents. Decoding one is therefore an entirely local, offline operation, which is what makes doing it in the page possible at all.
It is also why where you decode a token matters. A JWT in a bug report is usually a live credential: anyone who holds it can act as that user until it expires. Pasting one into a website that decodes it server-side hands it over in full, which is the single strongest reason for this tool to have no server behind it.
How to use it
- 1
Paste the token
The whole thing, with or without a leading Bearer. Three sections separated by dots.
- 2
Convert
The header and payload appear as formatted JSON, with the timestamp claims spelled out as dates.
- 3
Check the expiry
The exp claim is annotated as expired or still valid, read against your device's clock.
- 4
Copy what you need
Copy the decoded output, or download it as a .json file.
Frequently asked questions
Is my token sent to a server?
No, and that is the point of this page. The token is split and Base64-decoded in your own tab. A JWT is usually a live credential, so anything that transmitted it would be handing over an account.
Can it verify the signature?
No, deliberately. Verifying needs the signing secret or the public key, and asking anyone to paste a signing secret into a web page is exactly the practice this site exists to avoid. The signature is shown so it can be compared by eye, and labelled unverified so its presence is not mistaken for approval.
Is a JWT encrypted?
No. The header and payload are Base64url-encoded JSON, which is an encoding, not encryption — anyone with the token can read them. Never put anything in a JWT payload that the holder should not see.
Why does it say my token is expired when the server accepts it?
The exp claim is compared against your own device's clock. If that clock is wrong, or the server allows a few seconds of leeway for clock skew, the two can disagree around the boundary.
Nothing decodes — is my token broken?
Check that it has three sections separated by dots and that nothing was truncated when it was copied. A line break in the middle, or a missing final section, is the usual cause.