JWT Decoder
Decode a JSON Web Token's header and payload to inspect its contents, without verifying the signature.
Paste a JWT to decode its header and payload.
This decodes the token's contents only — it does not verify the signature, so it can't confirm a token is authentic or untampered with.
Overview
JWTs are used constantly in authentication systems but are unreadable at a glance. This tool decodes the header and payload sections so you can inspect claims like expiration, issuer, and custom fields.
- Instant decoding as you paste a token
- Flags expired tokens based on the exp claim
- Nothing is sent to a server
How to use it
- 1Paste a JWT
- 2Review the decoded header and payload
Frequently asked questions
Does this verify the token is valid or untampered?
No — it only decodes and displays the header and payload contents. Verifying a signature requires the signing secret or public key, which this tool never has access to.
Is it safe to paste a real token here?
The decoding happens entirely in your browser and nothing is transmitted anywhere, but as a general practice, avoid pasting production tokens with sensitive claims into any third-party tool.