JWT decoder
Read the header and payload of a JWT in your browser without sending it to any server.
Private: it runs in your browser and what you type is never sent anywhere. How to check it
Your files are processed here, on your device
We do not send the contents of your files or text to any server: everything is processed in your browser’s memory. No account is needed, there is no daily quota and we use no analytics or trackers. Each tool has size limits to protect your device’s memory.
A connection is only needed to load the site. After that you can disconnect and the tools keep working (some previews may need the connection). Hosting may receive technical visit data. Favorites store only tool identifiers in this browser.
How we handle your data →How to use this tool
- Paste the complete token with its three parts.
- Decode and review the header and payload.
- Check the expiry and remember the signature is not verified.
An example you can verify
Read the contents of a JWT without sending it to any server.
Example input
A sample token with a name, issue time and expiry.
Expected result
The header, the JSON payload and key facts: algorithm, issue time, expiry and state.
Decoding does not validate the token. To trust it, verify its signature on your server with the issuer’s key.
JWT decoder: uses and practical guidance
A JWT (JSON Web Token) is a string with three dot-separated parts: header, payload and signature. The first two are JSON encoded in Base64URL, not encrypted, so anyone holding the token can read them. This is why a JWT must not contain secrets such as passwords. This tool decodes both parts in your browser and shows them formatted, together with the declared algorithm and the issue and expiry times in UTC.
Decoding is not validating. The signature guarantees that the content was not altered and that it was issued by whoever holds the key, but checking it requires that key and happens on the server receiving the token. A token with a wrong signature decodes just the same. The displayed information is therefore useful for debugging and understanding an integration, not for deciding whether a request can be trusted.
The state tells you whether the expiry time has already passed according to your device clock. A token may have no expiry, or a not-before time in the future. Although everything is processed locally, handle real tokens carefully: pasting them in a chat, a shared document or an external site can give access to anyone who sees them. If in doubt, use a test token and revoke any you have exposed.
When debugging an integration, start with the algorithm and the dates. An unexpected algorithm, such as none, is a warning sign in any system that receives tokens. If a token is rejected, compare its expiry with the server time, because a drifting clock explains many intermittent failures. Also check the issuer and audience, which must match what your service expects. When you share an example in an issue, replace personal data and the signature with fictitious values: a real token, even an expired one, can reveal internal identifiers.
A practical check before using the result
Change one letter of the sample token’s signature: it still decodes, which shows that the tool does not verify signatures. Change one letter of the payload and see how the JSON changes or a format error appears.
Settings and limits
Paste a token with its three dot-separated parts (the Bearer prefix is accepted). The header and payload are decoded, showing the algorithm, issue time, expiry and whether it has already expired. The signature is not verified: reading a token does not prove it is authentic. Everything happens on your device.
Frequently asked questions
Does it check that the token is valid?
No. Decoding only reads Base64URL-encoded data. To know whether a token is authentic, its signature must be verified with the issuer’s key on your server.
Is it free, and do I need to sign up?
Yes, it is free. You do not need to sign up, create an account or install an app, and there is no daily quota: open the tool and use it. The only limits are file sizes, which protect your device’s memory.
Is my data sent to any server?
No. What you type or paste is processed in your browser’s memory and is not sent to any server. You can check it in the browser’s Network tab or by going offline after the page has loaded.
Guides
Discover the three parts of a JWT, what each date means and why decoding a token is not the same as validating it.
Use your browser’s Network tab and offline mode to see whether a PDF, image or video tool uploads your file, and learn what that test can and cannot prove.