JWT Decoder
Decode JSON Web Tokens online. Inspect JWT header and payload instantly. Free, runs entirely in your browser.
Header and payload appear here
Decoding happens locally. Nothing is sent to any server.
Frequently asked questions
- Is it safe to decode a JWT in my browser?
- Yes. Decoding happens locally in JavaScript and nothing is sent to a server. Just remember that a decoded token still contains whatever claims it was issued with.
- Does this tool verify the token signature?
- No. It only decodes and displays the header and payload. Signature verification requires the secret or public key and must be done on your server.
- What do the exp and iat fields mean?
- They are standard claims: exp is the expiration time and iat is the issued-at time, both in Unix seconds. The tool converts them to readable dates and marks expired tokens.
- Why does it say the input is not a JWT?
- A JWT consists of three dot-separated parts: header, payload and signature. If you get an error, check that you copied the complete token.
This tool runs entirely in your browser. No data is uploaded anywhere.