Decode a JWT
Header, payload and expiry status, without sending the token anywhere.
Runs on your device — never uploaded
How to decode a JWT
- Paste the token
The three Base64URL parts are split and decoded.
- Read the claims
iat, exp and nbf are shown as dates with an expired/valid flag.
- Copy JSON
Header or payload as formatted JSON.
Frequently asked questions
Is my token uploaded?
No. Unlike many JWT sites, decoding happens in your browser only, so it is safe for production tokens.
Does it verify the signature?
Not yet. It decodes and inspects; signature verification with a public key is on the roadmap.
Why is the payload readable without the secret?
JWTs are signed, not encrypted. Anyone with the token can read its claims.