LocalToolsOffline browser tools collection

Category: Developer tools

JWT Decoder

Decode JSON Web Token header and payload in your browser

Paste a JSON Web Token to read its header, payload and standard claims. Decoding happens in your browser and the signature is never verified remotely.

AlgorithmHS256TypeJWTValidity window…
Issued at (iat)2023-11-14T22:13:20.000ZNot before (nbf)Not presentExpires at (exp)2030-03-17T17:46:40.000Z
Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload
{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "role": "editor",
  "iat": 1700000000,
  "exp": 1900000000
}
Signature (Base64url, not decoded)
S2R4bV9sb2NhbC1zaWduYXR1cmUtZXhhbXBsZQ

Signature not verified. This page only decodes the token in your browser; it never sends it anywhere and does not check whether the signature is valid.

Everything on this page is processed in your browser. Nothing is uploaded.

What this tool does

A JSON Web Token is three Base64url segments joined by dots: a header describing the algorithm, a payload of claims, and a signature. This decoder splits the token, decodes the first two segments as UTF-8 JSON, and highlights the claims that control validity — issued at, not before and expiry — so you can see at a glance why a token is being rejected. The signature is shown as it appears in the token and is never checked, because verifying it would require the signing key.

How to use it

  1. Paste your token into the input box, or load the example.
  2. Read the algorithm, type and validity window in the summary.
  3. Copy the decoded header or payload JSON if you need it elsewhere.

Privacy

This tool runs entirely in your browser. Your input is never uploaded, stored or shared — closing the tab removes it.

Frequently asked questions

Is my token sent to a server?
No. The token is split and decoded by your own browser, so it never leaves the page. Even so, treat any token you paste anywhere as exposed and rotate it if it is a live credential.
Does this verify the signature?
No. Signature verification needs the secret or public key that signed the token, and this tool deliberately does not ask for one or contact a server. Verify tokens in your backend instead.
Why does my payload look unreadable?
Encrypted tokens (JWE) have five segments and cannot be decoded without the key. This tool reads signed tokens (JWS), which have three.

Back to all tools