Tools / JWT Decoder

JWT Decoder

Decode JWT headers and payloads instantly — nothing leaves your browser

Paste a JWT above — it decodes as you type. Nothing you paste here is sent anywhere.

About

A JSON Web Token is three base64url segments joined by dots: a header naming the signing algorithm, a payload carrying the claims — who it's for, when it expires, whatever else the issuer put in it — and a signature proving the first two haven't been tampered with, assuming you hold the right key. This tool decodes the header and payload back into readable JSON. That's it.

Decoding just reverses the encoding — it checks nothing. A forged, expired, or wrongly-signed token decodes exactly as cleanly as a legitimate one, because decoding never touches the signature. The status badge above the panels reads exp, nbf, and iat, if present, against your local clock, ticking live — it tells you whether a token's time window is currently open, nothing more. It is not a substitute for real verification, which needs the issuer's key and belongs on a server, never a browser tab.

FAQ

Is it safe to paste a JWT here?
Yes, in the sense that matters: this tool runs entirely in your browser, and the token you paste is never sent to a server, logged, or stored anywhere — refreshing or closing the tab discards it completely. That said, JWTs are bearer tokens: anyone holding a valid one can use it, so treat production tokens as secrets no matter which tool you paste them into.
Why doesn't it verify signatures?
Verifying a signature requires the same secret or public key the issuer signed it with — not something you'd want to hand to a random web tool, and not something this one asks for. This is a decode-only tool by design: it shows you what's inside a token, not whether it's authentic. Verification belongs in your application code, where the key already lives.
Why does this show my token as "expired" when my app still accepts it?
Usually one of two things. Either the service validating the token has a clock running slightly behind yours — this tool checks exp and nbf against your local clock, so if your machine is a little fast it will call a token expired just before that server does. Or the verifier is deliberately allowing some clock-skew leeway: JWT libraries offer an optional tolerance for exactly this (jsonwebtoken calls it clockTolerance, PyJWT and python-jose call it leeway), and RFC 7519 §4.1.4 explicitly permits “some small leeway, usually no more than a few minutes.” That leeway is off by default, though — most libraries apply zero unless you set it. This tool applies none either; it compares exp and nbf to your clock exactly.

Related

/tools/unix-timestamp
Unix Timestamp Converter
Timestamps to dates and back — seconds, millis, or micros, auto-detected
/tools/uuid-generator
UUID Generator
Generate v4 and v7 UUIDs in bulk — client-side, cryptographically random