JWT Decoder
Paste a token to see its header, payload and signature. Nothing uploaded.
How JWT Decoder works
Drop the three-part `header.payload.signature` string into the input box.
We base64url-decode header + payload and render them as JSON. Timestamps (iat, exp, nbf) are converted to ISO 8601 automatically.
Expired tokens are called out in red. The signature is displayed but NOT verified — that requires the secret and issuer's algorithm.
Frequently asked
Do you send my JWT to a server?+
No — decoding happens entirely with atob() + JSON.parse in your browser. Your token never leaves this tab.
Why don't you verify the signature?+
Verification requires the shared secret (HS*) or the issuer's public key (RS*/ES*). We can't verify without those. Use jsonwebtoken (Node) or your framework's built-in verifier.
What if my JWT is expired?+
The exp row shows the ISO time and appends `· EXPIRED` in red. You'll need to re-authenticate to get a fresh one from the issuer.