🎟 JWT Decoder

Paste a JSON Web Token to decode its header and payload — entirely in your browser.

This tool only decodes. It does not verify the signature, since that needs the issuer's secret or public key. Never paste a token you don't trust into a page whose signature verification you can't check.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header

—

Payload

—

Signature

—

Shown as-is (still Base64URL-encoded) — verifying it requires the signing key, which this tool never has.

How to Use This Tool

Paste any JWT into the box above and its header and payload are decoded and pretty-printed instantly. Standard time claims (exp, iat, nbf) are also translated into local date/time with a plain-English "expires in…" or "expired…" note.

Handy for debugging auth flows — checking what claims an access token actually carries, or why it's being rejected as expired — without needing to trust a third-party site with the token.