Free · No signup · Runs in your browser
JWT Decoder
Paste a JSON Web Token and read its header and payload as clean JSON, with epoch claims rendered as UTC times — decoded entirely in your browser.
Paste a JSON Web Token and read its header and payload as clean JSON, with epoch claims rendered as UTC times — decoded entirely in your browser.
Paste a token, get a labelled report instantly. The decoder splits the token on its dots, base64url-decodes the header and payload, and pretty-prints both — then translates the time claims into readable UTC.
Drop the full JWT — three base64url segments joined by dots — into the box. The signature segment is kept for structure but never verified.
The HEADER and PAYLOAD sections appear as formatted JSON. Standard time claims (iat, nbf, exp, auth_time) are also shown as UTC timestamps.
The status line names the signing algorithm and flags the token as expired when its exp claim is in the past. Copy or download the report when you're done.
A JWT often carries identity, scopes, and session data. Pasting one into a server-backed decoder ships that payload to someone else's machine. This tool never does.
Decoding runs in pure client-side JavaScript. Your token is never uploaded, logged, or stored — close the tab and it's gone.
We split and base64url-decode the token without any secret or public key. You see exactly what the token claims, with no signature step to fail on.
Epoch seconds are unreadable at a glance. We render iat, nbf, exp, and auth_time as UTC strings and mark a past exp as expired.
A token that isn't three dot-separated parts, or whose segments aren't valid base64url JSON, returns a clear message instead of a crash or garbage.