JWT Decoder

JWT (JSON Web Token) is a standard for transferring data between parties as JSON. Decoding is useful for debugging: viewing token contents, checking claims (exp, sub, roles), and diagnosing authentication issues.

A JWT’s header and payload aren’t encrypted—they’re Base64-encoded and can be read by anyone. Only the signature contains the secret. Our tool runs locally in your browser; data isn’t sent to a server. Still, don’t paste high-privilege tokens into unfamiliar services.

Signature verification requires a secret key known only to the server. The tool decodes the token structure but cannot verify the signature without your key. For full verification, use libraries in your application.

JWT payloads often include an exp (expiration) field — an expiration time in Unix timestamp format. The tool detects exp automatically and shows whether the token has expired, using your local time zone.

No, the tool only works with JWS (signed tokens). JWE (JSON Web Encryption) requires a key to decrypt and is not supported online for security reasons.