JWT Decoder

See exactly what a JWT carries — header, payload and timestamps — without sending it anywhere.

About this tool

A JSON Web Token looks like random noise, but its first two parts are just Base64URL-encoded JSON. This decoder splits the token, pretty-prints the header and payload, and translates timestamp claims such as exp and iat into readable dates — all locally, so even sensitive tokens stay on your machine.

How to use it

  1. Paste the token (the header.payload.signature string from a request header or cookie).
  2. Click Decode JWT and read the parts, or copy them as JSON.

Good to know

  • Decoding is not verification: the signature is shown but not checked. A token’s claims only become trustworthy after your server verifies the signature.
  • exp is shown with a relative “from now” hint, so expired tokens are obvious.
  • Nothing you paste is logged, stored or transmitted — the page works offline after loading.