JWT Decoder
Inspect the header and payload of a JWT.
Runs 100% in your browser — nothing is uploaded
Decode and inspect JSON Web Tokens in your browser. See the header and payload formatted, and read expiry and issued-at times in plain language. Decoding only — nothing is verified, sent, or stored. Never paste production secrets.
Frequently asked questions
Does it verify the signature?
No. It only decodes the header and payload. It does not and cannot verify that a token is authentic — never trust an unverified token.
Is my token uploaded?
No. Decoding happens entirely in your browser, so nothing is sent to a server.
Should I paste real tokens?
Avoid pasting production or sensitive tokens anywhere. Use test tokens, since a JWT payload is readable by anyone.
What do exp and iat mean?
'exp' is the expiry time and 'iat' is when the token was issued — the decoder shows both as readable dates.
Related tools
Handy companions people often use alongside JWT Decoder.