JWT Decoder
Paste a JWT (JSON Web Token) to instantly see its decoded header and payload as pretty-printed JSON, with exp/iat/nbf numeric date claims converted to human-readable timestamps. This is a decode-only tool. It never verifies the signature, so it's safe to use for inspecting a token's contents without any secret or key, and the token never leaves your browser.
Reviewed by Vincenzo Manto, Founder & Lead Developer · Last updated September 27, 2026
How it works
- 1
Paste your JWT (the three dot-separated base64url segments) into the input box.
- 2
The header and payload are decoded and pretty-printed as JSON automatically.
- 3
Any exp, iat, or nbf numeric claims are shown alongside their human-readable date equivalents.
- 4
Copy the decoded header or payload with one click. The signature is shown but never validated.
What a JWT actually contains
A JSON Web Token is three base64url-encoded segments joined by dots: a header describing the signing algorithm and token type, a payload holding the claims (like user id, roles, or expiry), and a signature that proves the first two segments haven't been tampered with. The header and payload are not encrypted, just encoded, so anyone can read them. That's exactly what this tool lets you do quickly without writing a script.
Decode-only, by design
A lot of confusion around JWTs comes from conflating 'I can read this token' with 'this token is valid.' This tool deliberately draws that line: it shows you exactly what's inside a token's header and payload for debugging, without ever asking for a secret key or claiming to validate anything. If you need to verify a signature, that belongs in your backend code where the signing key actually lives.
Not a generic Base64 tool, on purpose
A plain Base64 decoder will happily decode one JWT segment at a time, but you'd have to split the token yourself, guess which part is which, and convert the Unix timestamps by hand. This tool does all three automatically because it's built around the JWT's specific three-part structure, not generic text.
Frequently asked questions
Does this tool verify the JWT's signature?
No, and it never will. Verifying a signature requires the signing secret or public key, which this tool intentionally never asks for. It only decodes and displays the header and payload - treat it as a JSON viewer for tokens, not a security check.
Is my token sent to a server?
No. Splitting the token and base64url-decoding the header and payload all happens locally in your browser with plain JavaScript. Nothing is ever transmitted anywhere, which makes it safe to paste real tokens while debugging.
What does it do with exp, iat, and nbf?
JWTs express these standard timestamp claims as a 'NumericDate' - seconds since the Unix epoch. This tool converts each one it finds into a readable ISO 8601 date so you don't have to do the math yourself.
What if my token is invalid or malformed?
The tool checks that the token has exactly three dot-separated parts and that each of the header and payload segments is valid base64url-encoded JSON, and shows a clear error message if anything doesn't decode properly.
Can I decode tokens signed with any algorithm (HS256, RS256, ES256, etc.)?
Yes, the signing algorithm only affects the signature, which this tool doesn't touch. The header and payload are just base64url-encoded JSON regardless of algorithm, so decoding works the same for all of them.