JWT Decoder
Inspect the header and claims of a JSON Web Token.
Input
This tool runs entirely in your browser. The data you paste or load is never uploaded.
Result
Enter your input, then run the tool.
About this tool
Decodes the header and payload of a JWT so you can check claims, scopes and expiry without pasting a token into a server. The signature is shown as raw bytes and is explicitly not verified: this tool never has your signing key.
How to use it
- Paste a token in the form header.payload.signature.
- Read the decoded header and claims, including exp and iat as dates.
- Remember that decoding proves nothing about authenticity.
Frequently asked questions
Can this tool verify a signature?
No. Verification requires the secret or public key, which should never be pasted into a web page. Use your identity provider or a server-side library.
Is pasting a token here safe?
Decoding happens in your browser and nothing is sent to the server, but tokens are still credentials. Use a short-lived test token, and never paste production secrets.
Keep going
Related tools
Base64 Decoder
Decode Base64 back to readable text.
JSON Formatter
Pretty-print compact or broken JSON with a readable indentation.
UUID Generator
Generate cryptographically random UUID v4 and time-ordered v7.
JSON Validator
Check JSON syntax and see exactly where it breaks.
JSON Minifier
Strip whitespace from JSON to shrink payloads.
JSON to CSV Converter
Turn an array of JSON objects into a spreadsheet-ready CSV.