JWT Decoder
Decode a JSON Web Token (JWT) to inspect its header and payload. Does not verify the signature.
This only decodes the token's header and payload — it does not verify the signature (that requires the secret or public key, which a browser tool can never safely hold). Your token is decoded entirely in your browser and is never sent to a server.
This tool is temporarily unavailable.
Please check back later.
How to use this tool
- 1Paste a JWT (starting with "eyJ...") into the box.
- 2The decoded header and payload appear automatically as formatted JSON.
Features
- Decodes both the header and payload of a JWT.
- Clear error message if the token is malformed.
- No account or sign-up required.
Privacy
Your token is decoded entirely in your browser and is never sent to a server, logged or stored — important since JWT payloads often contain personal data.
Frequently asked questions
Is this JWT decoder free?
Yes, and there is no limit on how many tokens you can decode.
Does this verify the signature?
No. Verifying a signature requires the secret or public key used to sign it, which should never be pasted into a browser tool. This only decodes and displays the header and payload.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and the token is never sent anywhere — but as a general rule, avoid pasting production tokens into any tool you don't fully trust.
Why do I get an error?
A JWT must have exactly three dot-separated, Base64URL-encoded parts. Check that the token was copied in full and without extra whitespace.
Guides
- How to Check if a JWT Is Expired
Getting 401 errors? Decode the JWT, read its exp claim and convert the Unix timestamp to a date to see exactly when the token expired — free and private.
- What's Inside a JWT? How to Decode One Safely
A JWT looks like gibberish, but it's just Base64-encoded JSON. Here's what's actually inside a JSON Web Token and how to inspect one safely.
- Base64 vs Base64URL: Fix Invalid Characters and Missing Padding
Learn why Base64 decoding fails, how Base64URL changes the alphabet, and when to restore padding, with safe JavaScript examples.