JWT Decoder
Decode a JSON Web Token and inspect its header and payload.
Header
Payload
Signature (not verified)
Key features
Paste a JSON Web Token to instantly decode its header and payload into readable JSON — also flags whether it’s expired based on its exp claim, if present.
This only decodes the token; it does not (and cannot, without the secret or public key) verify its signature. Decoding happens entirely in your browser — the token is never sent anywhere.
How to use
Paste a JWT
Paste the full token, including all three dot-separated parts.
Read the decoded JSON
The header and payload are decoded and formatted instantly.
Check expiry
If the payload has an exp claim, this tool shows whether the token is still valid.
Frequently asked questions
Does this verify the token’s signature?
No. Verifying a signature requires the secret key (for HMAC algorithms) or public key (for RSA/ECDSA), which this tool never asks for or has — it only decodes the header and payload, which is safe since those are just Base64-encoded JSON, not encrypted.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and the token is never transmitted anywhere, so it's as safe as viewing it in your own browser console. That said, treat access tokens as sensitive — avoid pasting them into tools you don't trust, and this one included, if the token grants access to something sensitive.
Why does it say my token is malformed?
A JWT must have exactly three dot-separated, Base64URL-encoded parts (header.payload.signature). If a part is missing or isn’t valid Base64URL-encoded JSON, it can’t be decoded.