JWT Decoder

Safely decode and inspect JSON Web Tokens locally without sending data to a server.

Whenever possible, your data never leaves your device. Your security is our priority.

Live Token Inspector

Encoded JWT

Header (Algorithm & Type)

Payload (Data & Claims)

Verify Signature

About this Tool

JSON Web Tokens (JWT) are an open, industry-standard (RFC 7519) method for representing claims securely between two parties. They are widely used for modern web authentication and API authorization.

A standard JWT consists of three parts separated by dots: a Header (containing the algorithm), a Payload (containing the session data or user claims), and a Signature (to verify the token hasn't been tampered with).

How to Use

Paste your Token

Paste your raw JWT string into the encoded input box. The tool will instantly split the token at the dots (.).

View Decoded Data

The Header and Payload are Base64Url decoded back into readable JSON. The signature is displayed securely as raw output.

Check Expiration

If your payload contains an 'exp' or 'iat' claim, those are Unix timestamps indicating when the token expires or was issued.

Frequently Asked Questions

Yes. Because this tool runs 100% locally in your browser, your sensitive token data never leaves your device. We do not have servers to intercept your session claims.

No. This is a decoder, not a verifier. It unpacks the Base64Url data so you can read it. To verify a signature, you would need the original Secret Key (HMAC) or Public Key (RSA) used by the issuing server.

You can edit the payload text, but if you send that altered token back to a server, the server will reject it. Modifying the payload without possessing the Secret Key breaks the cryptographically secure Signature.