Developer tools
JWT Decoder
Decode JSON Web Tokens (header, payload, exp/iat) locally — never validates the signature.
Decoded locally — your token never leaves the browser. This tool does not verify the signature.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1700000000,
"exp": 1900000000
}Signature
signature_placeholder
Issued
Issued 957d ago
Expiration
Expires in 1357d
How it works
- 1Paste a JWT (three dot-separated base64url parts).
- 2See the decoded header and payload as JSON.
- 3Read the issued-at / expiration summary at a glance.
Use cases
- Debug why a token is being rejected.
- Inspect the claims on a third-party identity token.
- Build mock tokens during development.
Frequently asked questions
Does this verify the signature?
No. This tool only decodes the publicly readable header and payload. Signature verification requires the secret/public key and is not done here.
Is it safe to paste tokens?
Yes — decoding happens entirely in your browser. The token is never sent to any server. Still: prefer expired or test tokens when possible.
What if my token has 4 parts?
That is a JWE (encrypted JWT) which this tool cannot decode. Only JWS (signed JWT, 3 parts) is supported.
Read the guide
How to inspect a JWT without compromising it
A JWT is three Base64 strings joined by dots. Here is what each part means, what the decoder shows, and why the signature stays secret.