JWT Decoder

Decode a JSON Web Token to inspect its header and payload. Nothing leaves your browser.

Free tool No account

Input

Output

// HEADER
{
  "alg": "HS256",
  "typ": "JWT"
}

// PAYLOAD
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

// SIGNATURE (not verified — decode only)
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

About the JWT Decoder

Paste a JSON Web Token to read its header and payload: who it was issued to, when it expires and which permissions it carries.

How to use it

Paste the token (the three parts separated by dots).
Read the decoded header and payload.
Check the exp (expiry) and iat (issued at) times.

Tip: Decoding is not verifying: the signature is not checked, so never trust a token's contents without checking it on your server.

Questions

Is it safe to paste a real token here?

Decoding happens in your browser and nothing is sent anywhere — but treat live tokens like passwords and prefer expired or test tokens.

Is my data uploaded?

No. The tool runs in your browser; what you paste or open never leaves your device and nothing is stored on a server.