JWT Decoder
Paste a JWT and decode its header and payload locally for quick claim inspection.
Inspect JWT claims locally
JSON Web Tokens are just base64url-encoded JSON segments, but reading them by hand is awkward and error-prone. This decoder splits the token and parses the header and payload so you can inspect claims like subject, issuer, audience, and expiration in clean, formatted JSON — and it reads the exp claim to show you exactly when the token expires.
That makes it a fast way to debug authentication: confirm the right claims are present, check whether a token has already expired, and see what a service is actually issuing. Remember that decoding is not verification — a decoded token can still be forged if its signature does not validate.
No-upload token inspection
The token is decoded entirely in your browser and never transmitted. Still, treat production tokens with care and avoid pasting sensitive live credentials into any tool, here or elsewhere.
Frequently Asked Questions
Does this verify JWT signatures?
No. It decodes header and payload only. Signature verification requires the secret or public key.
Is it safe to paste production tokens?
Avoid pasting sensitive production tokens into any tool. This runs locally, but caution is still best.
What parts does it decode?
It decodes the header and payload from a standard three-part JSON Web Token.
Is my token uploaded?
No. Decoding happens in your browser.
Debug tokens and API payloads faster with browser utilities.