JWT decoder
Decode a JWT header and payload in your browser. Signature is not verified. Nothing is uploaded.
This page only decodes the header and payload. It does not verify the signature. Do not treat a decoded token as authentic.
Paste a JWT, then Decode. Signature is not checked.
How to use the JWT decoder
- Paste the token (three dot-separated parts, or two for some unsigned examples).
- Click Decode. Header and payload are Base64URL-decoded and pretty-printed when they are JSON.
- Read claims such as sub and exp. Do not trust them as proof of identity.
Display only
A JWT is signed so a server can reject a forged payload. This page never has your HMAC secret or public key workflow, and it does not check the third part. Anyone can mint a token with alg none or copy a payload. Treat the output as untrusted JSON.
Nothing is uploaded
Decode stays in the tab. 256 KB cap. exp, iat, and nbf are shown as ISO timestamps when they are numeric Unix times.
JWT decoder FAQ
Does this verify JWTs?
No. It only decodes. Verification needs the right key on a server you control.
alg none?
The sample is unsigned on purpose so you can see claims without a signature.
Pretty JSON?
If a part is JSON it is indented. Otherwise the raw decoded text is shown.