JWT decoder
Decode a JWT token (100% local)
Local decoding: nothing is sent to a server. The signature is not verified.
Read the contents of a JWT: header, payload, and issued-at and expiry dates. Decoding happens entirely in the browser, the token is never transmitted.
How it works
A JWT is three parts separated by dots, each encoded in base64url. The first two are plain JSON objects that anyone can read: encoding is not encryption. The third is a signature guaranteeing integrity, not confidentiality.
header.payload.signature each base64url encoded
Frequently asked questions
Is a JWT encrypted?
No. Its payload is only encoded and anyone can read it. Never put sensitive data in there: a password, a card number or a secret have no business in a token.
Does this tool verify the signature?
No, it only decodes. Verifying a signature requires the secret or public key, which belongs to the server that issued the token, not to a browser-side tool.
What do exp and iat mean?
They are Unix timestamps in seconds: iat marks when the token was issued, exp when it expires. The tool turns them into readable dates and flags an expired token.