JWT Decoder
Paste a JWT to instantly decode its header and payload — no signature verification, fully client-side.
How to use the JWT Decoder
- Paste a JWT into the JWT box.
- The Header and Payload panels decode automatically a moment after you stop typing, pretty-printed as JSON.
- If the payload has
iat,nbf, orexpclaims, they're shown below the payload as readable dates — with an Expired badge ifexpis in the past. - If the header's
algis"none", a warning badge appears next to Header. - The raw Signature segment is shown as-is for reference — it is not decoded or verified.
- Use the Copy buttons to copy the decoded header or payload JSON.
How This Tool Works
A JWT is three Base64URL-encoded segments joined by dots — header, payload, and signature. This tool splits on those dots, decodes the header and payload segments (handled as UTF-8 bytes, so non-ASCII claim values like names in other languages don't get mangled), and pretty-prints each as JSON. This tool only decodes — it does not verify the signature, and never asks for a secret or public key.
Standard date claims — iat, nbf, and exp — are additionally parsed from Unix seconds into readable local dates, with an Expired badge shown if exp is in the past. If the header's alg is none, a warning badge is shown: that means the token claims to be unsigned, a well-known JWT footgun. Nothing is ever sent to a server — decoding happens entirely in your browser, so it's safe to paste real tokens.