Decode a JWT
Paste a JSON Web Token to see its decoded header and payload instantly, with an expiry check if it has an exp claim.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Ada Lovelace",
"iat": 1516239022
}The signature (SflKxwRJSMeK…) isn't verified. That needs the issuer's secret or public key, which no client-side tool can have.
Drop in a full JWT. The three dot-separated parts.
Both are decoded and pretty-printed instantly, with an expiry check if the payload has an exp claim.
Copy either JSON block on its own.
Frequently asked
Is my token sent anywhere?
No. Decoding is just base64url + JSON parsing, done entirely in this tab. Nothing is sent anywhere.
Does this verify the signature?
No. Verifying a signature needs the issuer's secret (HMAC) or public key (RSA/EC), which a client-side tool never has. This only decodes the header and payload.
Is it safe to paste a real production token here?
Nothing leaves your browser, so it's as safe as pasting it into your own browser console. But treat tokens like passwords generally, and prefer a throwaway/test token when possible.
How is the expiry checked?
If the payload has an exp claim (a Unix timestamp), it's compared against your device's current clock.
Does this work offline?
Yes, once the page has loaded.