Decode a JSON Web Token to read its header, claims and expiry. Runs entirely in your browser, which matters when the token you are inspecting is a real credential.
Runs in your browser — nothing is uploaded
This decodes the token so you can read it. It does not verify the signature — anyone can read a JWT, so never trust its contents without checking the signature on your server.
Paste a token to decode it.
A JWT is a credential. This one never leaves your machine.
exp, iat and nbf are converted to readable dates with a clear expired flag.
No account, no usage cap, and no feature held back behind a paywall.
JWT parts use the URL-safe alphabet, which standard decoders reject.
Paste the token — all three dot-separated parts.
Read the decoded header and payload side by side.
Check the expiry banner to see whether it is still valid.
A JWT has three Base64URL-encoded parts separated by dots: a header naming the signing algorithm, a payload of claims, and a signature. The first two are encoded, not encrypted — anyone holding the token can read them.
That is the single most misunderstood thing about JWTs. Putting anything sensitive in a payload is equivalent to publishing it, because the holder of the token can decode it without any key.
This tool decodes. It does not check the signature, and it cannot — verification needs the secret or public key, which should never be in a browser.
A decoded token proves nothing about authenticity. An attacker can craft any payload they like and it will decode perfectly here. Always verify the signature server-side before trusting a single claim, and reject tokens whose algorithm header you did not expect.
Available tools are linked; the rest are in development.
We build internal tools, dashboards and automation that fit how your team works.