JWT Decoder - Free, Local, Never Verified Remotely
Paste a JSON Web Token to see its decoded header and payload. This only decodes the token's contents - it doesn't and can't verify the signature, since that needs the issuer's secret or public key.
Maintained by Hirantha Sandaruwan Lakshan. Updated 31 July 2026.
How it works
A JWT is three Base64url-encoded segments separated by dots: a header describing the signing algorithm, a payload holding the claims, and a signature. Only the first two are human-readable data.
The header and payload segments are Base64url-decoded and parsed as JSON to display their contents, exactly as any JWT library would read them before checking the signature.
The signature segment is shown but not checked - verifying it requires the secret key or public key used to sign the token, which this tool deliberately never asks for, so it can't be misused to fake a validity check.
Worked examples
Inspecting a token during API debugging
Paste an access token from a request header to see its claims - like expiry time, subject, and scopes - without needing to verify it.
Checking a token's expiry
Decode the payload and check the exp claim (a Unix timestamp) to see when the token expires - pair this with the timestamp converter to read it as a date.
Confirming which algorithm signed a token
The decoded header shows the alg field, useful when debugging a library that rejects a token for using an unexpected algorithm.
Frequently asked questions
Does this verify the token is genuine?
No - it only decodes the readable parts. Verifying the signature requires the issuer's key, which this tool never asks for or transmits.
Is my token uploaded anywhere?
No, decoding happens entirely in your browser tab. Even so, treat tokens as sensitive and avoid pasting production tokens into any tool you don't trust.
Why does it say the token is malformed?
A JWT must have exactly three dot-separated segments, each valid Base64url. Anything else - a truncated paste, extra whitespace - is flagged rather than partially decoded.
Can I edit and re-sign a token here?
No, this is read-only decoding. Re-signing would need the secret key, which is exactly what should never be pasted into a browser tool like this.
What are the three parts of a JWT?
Header, payload, and signature, separated by dots. The header names the algorithm, the payload carries the claims, and the signature is what proves the first two weren't tampered with.
Is it safe to paste a real token here?
Decoding happens entirely in your browser tab and nothing is transmitted. That said, a valid token is a live credential, so treat pasting one anywhere with the same care you'd give a password.
Why can anyone read my JWT payload?
Because it's only Base64-encoded, not encrypted. The signature stops it being modified, but it was never designed to hide the contents - so never put secrets in a JWT payload.
How do I check if a token has expired?
Look at the exp claim in the payload, which is a Unix timestamp. The timestamp converter will turn it into a readable date.
Sources & references
Updated Jul 31, 2026