JWT Decoder
Decode JWT tokens online for free. Inspect the header, payload, issued and expiry times of any JSON Web Token instantly — fully in your browser, nothing uploaded.
Decoding happens entirely in your browser and the signature is not verified. Avoid pasting production tokens that grant access to live systems.
Frequently asked questions
- Is my token sent to a server?
- No. Decoding happens entirely in your browser and the token never leaves your device. Even so, avoid pasting live production tokens anywhere as a general precaution.
- Does this verify the JWT signature?
- No. It decodes the header and payload so you can inspect the claims, but it does not check the signature. Signature verification requires the signing secret or public key and should happen on your server.
- Why can a JWT be decoded without the secret?
- The header and payload are only Base64url-encoded, not encrypted, so anyone holding a token can read its contents. The secret is needed only to verify or create the signature.