Online Tool Store
JWT Decoder
Paste a JWT to decode its header and payload as readable JSON, with expiry status shown if present. Runs entirely in your browser.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Example shown — paste your own token.
Header
Payload
How it works
- Paste a JWT.
- Its three dot-separated parts are split, and the header and payload are base64url-decoded as JSON.
- If the payload has an expiry claim, it's shown as a readable date.
FAQ
Does this verify the token's signature?
No — it only decodes the header and payload, which are just base64url-encoded JSON and not encrypted. Signature verification would need the signing secret or public key, which this tool never asks for.
Is a JWT encrypted?
No — by default a JWT's header and payload are only encoded, not encrypted. Anyone with the token can read its contents, which is why sensitive data shouldn't be put in a JWT payload.
Is my token uploaded anywhere?
No — decoding happens entirely in your browser.
Why does it say my token is expired?
If the payload has an "exp" claim (a Unix timestamp), it's compared against your device's current time to show whether the token has already expired.
How we compare
| Feature | Online Tool Store | Manual base64 decoding | Other online JWT tools |
|---|---|---|---|
| No file upload — runs in your browser | ✓ | ✓ | ✗ |
| Readable expiry date, not just a timestamp | ✓ | ✗ | ✓ |
Manually splitting and base64-decoding a token is tedious. JWT Decoder gives you readable JSON instantly, without sending the token anywhere.