🎫 JWT Decoder
Paste a JWT to see its header and payload as formatted JSON, with exp, iat and nbf shown as real dates and an at-a-glance expired or valid badge. Decoding is done in your browser — the token is never transmitted.
🔒 A JWT is only encoded, not encrypted — anyone holding it can read the payload. This tool does not verify the signature, so never paste a production token you still rely on.
—
—
🔒 Runs 100% in your browser. Your data never leaves your device.
How to use
- Paste the token — the part that looks like eyJhbGci… with two dots in it.
- Read the header and payload as formatted JSON.
- Check the exp badge to see whether the token is still valid.
FAQ
Does this verify the signature?
No. Verifying requires the secret or public key, which you should never paste into a website. This tool only decodes the base64url segments.
Is my token sent anywhere?
No. Decoding happens in your browser with atob(). Nothing leaves the page — but treat any token you paste anywhere as compromised anyway.
Why is the payload readable without a key?
JWTs are signed, not encrypted. The signature proves the token was not tampered with; it does not hide the contents. Never put secrets in a payload.