Decode JSON Web Tokens (JWT) locally to inspect header and payload data instantly and securely in your browser.
How to use it
- Paste your JWT into the input box.
- Read the decoded header and payload.
- Check the expiry status shown next to the claims.
Frequently asked questions
Is it safe to paste a real token here?
Decoding happens entirely in your browser and the token is never sent anywhere. Even so, treat any token you have shared elsewhere as compromised and rotate it.
Does this verify the signature?
No. Verification needs the secret or public key, which stays on your server. This tool shows what the token contains, not whether it is authentic.
Why is a JWT readable by anyone?
Because the payload is only Base64 encoded, not encrypted. The signature protects against tampering, not against reading, so never put secrets in a token.