JWT Decoder — Inspect JSON Web Tokens
Decode a JWT's header and payload and check expiry — without sending it anywhere.
A JSON Web Token is three Base64URL segments separated by dots: header, payload and signature. This tool splits the token, decodes the header and payload to formatted JSON, and renders time-based claims (exp, iat, nbf) as human-readable dates with an expiry status.
Crucially, decoding happens entirely in your browser — the token is never transmitted. That matters, because a JWT is a bearer credential: pasting a live one into a server-side tool effectively hands over the session.
Features
- Decoded header and payload as pretty JSON
- Standard claims (exp, iat, nbf, iss, aud, sub) highlighted
- Expiry check with time remaining or time since expiry
- Algorithm and token type from the header
- Warns on the "alg: none" anti-pattern
- 100% client-side — nothing leaves your browser
How to use the jwt decoder
- Paste the full JWT (three dot-separated parts).
- Read the decoded header and payload panels.
- Check the expiry badge and the formatted exp / iat dates.
Frequently asked questions
Does this verify the signature?
No. Signature verification needs the issuer's secret or public key. This tool decodes and inspects claims only. Never trust an unverified token in production code.
Is it safe to paste a real token here?
Safer than most tools, because decoding runs locally and the token is not sent over the network. Still, treat any real token as a live credential and revoke it if in doubt.
What does "alg: none" mean?
It is an unsecured JWT with no signature. Accepting these is a well-known vulnerability; libraries should reject them unless explicitly configured otherwise.
Last updated September 10, 2026.