JWT Decoder (Decode Only — Never Uploaded)

Paste a token to read what it says. It is decoded in your browser; the token is never sent anywhere.

Runs in your browser — nothing you enter is uploaded

Your result will appear hereFill in the fields and press “Decode token”.

Formula

JWT = base64url(header) . base64url(payload) . signature

Decoding only reverses the Base64URL; it does not check the signature.

The first two parts are just encoded JSON anyone can read.

Worked example

A sample HS256 token

JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUiLCJpYXQiOjE1MTYyMzkwMjJ9.c2lnbmF0dXJl

Result

Decoded — signature not verified

Algorithm: HS256

Signature present: Yes — NOT verified

{
  "alg": "HS256",
  "typ": "JWT"
}

How it works

A JSON Web Token has three dot-separated parts. The first two are Base64URL-encoded JSON — the header (algorithm and type) and the payload (the claims). This tool decodes them and presents the standard time claims — iat (issued at), nbf (not before) and exp (expires) — as dates, relative to your device clock.

Decoding is not verifying. Anyone can create a token with any contents; only checking the signature with the right key proves it came from the issuer, and this tool never does that, so never trust decoded claims for access decisions. Tokens with the algorithm “none” are flagged as unsigned, and encrypted (five-part) tokens can't be read without the key.

The token stays in your browser and share links are disabled for this tool. For the Base64 step see Base64 Encode and Decode; to tidy the JSON use the JSON Formatter; to convert timestamps use the Unix Timestamp Converter.

Assumptions and limits

Signatures are not verified. The 'expired' note relies on your device clock.

Decoding is not verifyingThis tool only decodes the token. It never checks the signature, so don’t treat its contents as trustworthy or use it to make access decisions.

Common questions

Is it safe to paste a real token?

The token is processed locally and never uploaded. Still, treat live tokens as passwords — prefer expired or test tokens when you can.

Base64 Encode and DecodeEncode text to Base64 or decode Base64 to text, with URL-safe output and full Unicode support.JSON FormatterPretty-print JSON with 2 or 4 spaces or tabs and optional key sorting — numbers are never altered.Unix Timestamp ConverterConvert Unix timestamps (seconds or milliseconds) to dates and dates to timestamps, in UTC or local time.UUID GeneratorGenerate random UUID v4 or time-ordered UUID v7 values in bulk, in your browser.URL Encode and DecodePercent-encode or decode URLs and query values — as a component, a full URL or form data.Hash GeneratorGenerate SHA-256, SHA-384, SHA-512 and SHA-1 hashes of any text, in your browser.

All developer tools Browse the full tool directory

JWT Decoder