About JWT decoder
A JSON Web Token is three base64url-encoded parts joined by dots: a header saying which algorithm signed it, a payload holding the claims, and a signature. The first two parts are merely encoded, not encrypted — anyone holding the token can read them. This tool does that decoding locally so you can see what a token actually contains.
Paste a token and you get the header, the payload formatted as readable JSON, and any timestamp claims converted from seconds-since-epoch into real dates. Expiry is the claim people usually want: `exp` is flagged as expired or still valid against your current clock, and `nbf` is flagged if the token is not valid yet. Reading `1735689600` and working out whether that is in the past is exactly the kind of thing a machine should do for you.
This tool does not verify signatures, on purpose. Verification requires the issuer's signing secret or public key. Any site offering to verify your token is asking you to paste a production credential into someone else's server, and a surprising number of them do exactly that. Decoding tells you what a token claims; only your own backend, holding the key, can tell you whether those claims are trustworthy.
Treat tokens as live credentials. A JWT is usually a bearer token: whoever holds it can act as the user it describes until it expires. That is the reason this runs client-side. Your token never reaches our servers, never lands in an access log, and never sits in someone's error tracker. The page has no network permission to send it even if it wanted to — that is enforced by our Content Security Policy, not merely promised in a privacy page.
Common problems. A token that fails to split into three parts is usually truncated, or was copied with the `Bearer ` prefix still attached, or picked up a line break in transit. A part that fails to decode is usually not a JWT at all — plenty of opaque session tokens look similar but carry no structure. And a token that decodes but seems wrong is often simply expired; check the `exp` line first.
Questions
Is my token sent to your server?
No. Decoding happens entirely in your browser and the token never leaves your device. Since a JWT is usually a live credential, that distinction matters.
Why can I read the payload without a key? Is that a bug?
No — that is how JWTs work. The payload is base64url-encoded, not encrypted. Signing proves a token was not altered; it does not hide the contents. Never put secrets in a JWT payload.
Can you verify the signature?
No, deliberately. That would require your signing secret or public key, and pasting a production key into a web page is a bad idea regardless of who runs it. Verify on your own backend.
It says my token has the wrong number of parts.
It is usually truncated, still carrying a "Bearer " prefix, or broke across a line when copied. Some session tokens also just are not JWTs.