# JWT Decoder - Free, Local, Never Verified Remotely

Page: https://hirantha.me/tools/jwt-decoder
Part of: Hirantha Sandaruwan Lakshan free tools (https://hirantha.me/tools)
Updated: 2026-07-31

Decode a JSON Web Token's header and payload without verifying it.

This is a free tool that runs in the browser: open the page to use it. File tools process files on the visitor's own device; files are never uploaded or stored. No account, sign-up, payment or watermark.

Paste a JSON Web Token to see its decoded header and payload. This only decodes the token's contents - it doesn't and can't verify the signature, since that needs the issuer's secret or public key.

A JWT is three Base64url-encoded segments separated by dots: a header describing the signing algorithm, a payload holding the claims, and a signature. Only the first two are human-readable data.

The header and payload segments are Base64url-decoded and parsed as JSON to display their contents, exactly as any JWT library would read them before checking the signature.

The signature segment is shown but not checked - verifying it requires the secret key or public key used to sign the token, which this tool deliberately never asks for, so it can't be misused to fake a validity check.

Q: Does this verify the token is genuine?
A: No - it only decodes the readable parts. Verifying the signature requires the issuer's key, which this tool never asks for or transmits.

Q: Is my token uploaded anywhere?
A: No, decoding happens entirely in your browser tab. Even so, treat tokens as sensitive and avoid pasting production tokens into any tool you don't trust.

Q: Why does it say the token is malformed?
A: A JWT must have exactly three dot-separated segments, each valid Base64url. Anything else - a truncated paste, extra whitespace - is flagged rather than partially decoded.

Q: Can I edit and re-sign a token here?
A: No, this is read-only decoding. Re-signing would need the secret key, which is exactly what should never be pasted into a browser tool like this.

Q: What are the three parts of a JWT?
A: Header, payload, and signature, separated by dots. The header names the algorithm, the payload carries the claims, and the signature is what proves the first two weren't tampered with.

Q: Is it safe to paste a real token here?
A: Decoding happens entirely in your browser tab and nothing is transmitted. That said, a valid token is a live credential, so treat pasting one anywhere with the same care you'd give a password.

Q: Why can anyone read my JWT payload?
A: Because it's only Base64-encoded, not encrypted. The signature stops it being modified, but it was never designed to hide the contents - so never put secrets in a JWT payload.

Q: How do I check if a token has expired?
A: Look at the exp claim in the payload, which is a Unix timestamp. The timestamp converter will turn it into a readable date.

Sources: JSON Web Token - Wikipedia (https://en.wikipedia.org/wiki/JSON_Web_Token); Window: atob() method - MDN (https://developer.mozilla.org/en-US/docs/Web/API/Window/atob)

Related tools:

- [Base64 encode & decode](https://hirantha.me/tools/base64.md): Convert text to Base64 and back, right in your browser.
- [Timestamp converter](https://hirantha.me/tools/timestamp-converter.md): Convert between Unix epoch time and human-readable dates.
- [JSON formatter & validator](https://hirantha.me/tools/json-formatter.md): Pretty-print, minify, and validate JSON with clear error locations.
- [URL parser](https://hirantha.me/tools/url-parser.md): Split any URL into protocol, host, port, path, query parameters and fragment. Decodes percent-encoding, flags tracking parameters and rebuilds the URL.