JWT Decoder
Decode a JWT's header and payload (no signature check) locally
About JSON Web Tokens
A JWT has three dot-separated parts — header, payload, and signature — where the header and payload are Base64URL-encoded JSON. This tool decodes and pretty-prints the header and payload so you can inspect the claims. Everything runs locally in your browser.
FAQ
Does this verify the signature?
No. Decoding only reads the header and payload; it does not check the signature, so a decoded token isn't a validated one. Never trust a token's contents without verifying its signature on your server.
Is my token sent anywhere?
No. Decoding happens entirely in your browser — the token never leaves your device. Still, treat live tokens as secrets.
What do exp and iat mean?
iat is "issued at" and exp is the expiry, both as Unix timestamps. When an exp claim is present, this tool shows the expiry date and whether it has passed.