JWT Decoder
Decode a JSON Web Token to inspect its header and payload, with expiry status highlighted — no signature verification
Paste a JWT above
Paste a JWT above
Paste a JSON Web Token to instantly see its decoded header and payload as formatted JSON, plus an at-a-glance expiry status if the token has an exp or nbf claim. Decoding happens entirely in your browser — the token is never sent anywhere. Note this only decodes the token; it does not verify the signature, since that requires the issuer's secret or public key.
- Decodes header and payload as formatted JSON
- Highlights expired or not-yet-valid tokens
- Runs entirely in your browser — the token is never transmitted
Frequently asked questions
Does this verify the token is genuine?
No — it only decodes the header and payload for inspection. Verifying the signature requires the issuer's secret (HMAC) or public key (RSA/EC), which this tool intentionally does not ask for.
Is it safe to paste a real access token here?
Decoding happens entirely client-side and nothing is sent to a server, but a JWT is still a sensitive credential — treat it as you would a password and avoid pasting production tokens into any online tool unless you trust it.