JWT decoder
Decodes a JSON Web Token's header and payload locally in your browser. Decoded does not mean verified.
1 · Input
Nothing is sent to a server - the token never leaves this browser tab, is never stored, and is never logged.
Related Tools
More tools in the same category
Other Tools
Popular tools from across A2Z
What this does
Splits a JSON Web Token into its three segments and decodes the header and payload from Base64URL - showing the algorithm, standard claims (iss, sub, aud), and iat/nbf/exp as readable times with expiry state.
Decoded does not mean verified
This never checks the signature - a JWT's payload is Base64URL-encoded, not encrypted, so anyone can decode it without a key. Verifying that a token was genuinely issued by who it claims requires the actual signing key, which this tool never asks for or has. A token with alg: none is flagged - never treat that as secure.
Privacy
The token never leaves this browser tab - it is not sent to a server, not stored, and not logged.
Rate this tool
Was this tool useful? Your feedback helps us improve it.