yourbrowsercandoit

Decode a JSON Web Token

Paste a JWT and see the decoded header, payload, and signature segment. Honest note: this does not verify the signature.

Drop your file here

or click to browse

All files • or paste with ⌘V

How it works

Paste a JWT and see the decoded header, payload, and signature segment. Honest note: this does not verify the signature.

JWTs have three Base64URL-encoded sections separated by dots: header (claims about the algorithm and token type), payload (the actual claims like user ID, expiry, scopes), and signature (a hash of the header + payload, signed with the issuer's key). The tool decodes the header and payload as JSON and shows them formatted. The signature is shown raw as Base64URL because verifying it requires the issuer's public key, which you'd need to bring yourself. If the payload includes an exp claim, the tool shows the expiry timestamp and whether the token is currently within its valid window. Useful for debugging auth flows, checking what claims a service issued, and sanity-checking expiry times. Never trust the claims in a JWT without verifying the signature; this tool is for inspection only.

How to use it

  1. Paste your JWT. The three dot-separated sections are decoded locally — the token never leaves your browser.
  2. Read the header and payload. Both decode to formatted JSON showing the algorithm and claims.
  3. Check the expiry. If there's an exp claim, the tool shows the timestamp and whether the token is still valid.
  4. Don't trust unverified claims. This tool decodes only — always verify the signature server-side before trusting a JWT.

Frequently asked questions

Does this verify the JWT signature?
No. Signature verification requires the issuer's public key, which only the verifying service has. This tool decodes and displays the contents; you should never trust a JWT in production without a signature check.
Is my JWT uploaded?
No. Decoding happens in your browser. The JWT and any sensitive claims in it stay local.
Why is the signature shown as garbled text?
It's a raw cryptographic hash in Base64URL. It's not meant to be readable; it's meant to be verified.
Can I see when the token expires?
Yes, if the payload has an exp claim. The tool shows the ISO timestamp and whether it's currently within the valid window.

More in this category

Saved