JWT Decoder
Decode and inspect JSON Web Tokens (JWT) instantly in your browser without sending them to a server.
JWT Decoder
Decode and inspect JSON Web Tokens (JWT) instantly in your browser without sending them to a server.
About JWT decoding
Parse the three token parts
The decoder expects the standard header.payload.signature shape. It Base64URL-decodes the header and payload JSON, shows the algorithm when present, and converts exp into local time with an active or expired label.
Format valid is not signature verified
Format, cryptographic signature, and time claims are reported separately. You can provide a secret or public key to verify the signature locally, but the result never validates issuer, audience, certificate trust, login, or authorization policy.
FAQ
Common questions and answers about this topic.
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties as a JSON object.
What parts of a JWT are decoded?
The header and payload are decoded and displayed as formatted JSON. The signature segment is separated as text, and the page also shows expiration status and algorithm information when those claims exist.
Can this verify JWT signatures?
Yes. Provide an HMAC secret, public PEM, or public JWK/JWKS and the browser verifies HS, RS, PS, or ES signatures locally. A matching signature does not validate issuer, audience, certificate trust, or authorization policy.
Is my data sent to any server?
No, JWT decoding happens entirely in your browser. Your token is decoded locally with JavaScript — the token content is never sent to any server.