JWT Decoder
Paste a JSON Web Token to instantly see its decoded header and payload. Runs entirely in your browser, your token is never sent anywhere.
How to use this
Paste any JWT into the box above and its header and payload decode instantly, no login or backend required. If the token includes an expiration or issued-at timestamp, it's translated into a readable date automatically. If you know the signing secret and the token uses HS256, you can optionally verify the signature to confirm the token hasn't been tampered with.
Frequently asked questions
How do I decode a JWT?
Paste the token into the box. Its header and payload decode instantly, with no login or backend. Timestamps such as expiry and issued-at are shown as readable dates.
Can this tool verify a JWT signature?
Yes, for tokens signed with HS256, if you know the signing secret. Verification confirms the token has not been tampered with.
Does decoding a JWT mean it is valid?
No. Decoding only reads what the token says. A server must verify the signature and expiry before trusting it.
Is it safe to paste my token here?
The token is decoded in your browser and is not sent to a server. Still, avoid pasting live production tokens into any online tool when a test token will do.