JWT Decoder
Decode a JWT (JSON Web Token) header and payload. Signature verification is not performed.
How to use
- Paste a JWT string (
header.payload.signatureformat) - The header and payload JSON are pretty-printed
- Time-based claims such as
exp,iat, andnbfare converted to ISO dates when present
This only decodes the token — it does not verify the signature. It cannot confirm the token's authenticity or expiration validity, so don't use it to make trust decisions. Everything runs in your browser; there is no server communication.
Example
Pasting eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c shows {"alg":"HS256","typ":"JWT"} as the header, and sub, name, plus the converted iat date in the payload.
FAQ
Is the signature verified?
No. It only base64url-decodes the header and payload for display; it does not check signature validity.
Do I need to enter a secret key?
No. Since no verification is performed, there is no field for a secret.
What happens with a malformed JWT?
An error is shown if the token doesn't have 3 segments or if the decoded content isn't valid JSON.
Is my token stored anywhere?
No. Everything runs in your browser and disappears when you reload the page.
Tools to use next
- Convert between Unix timestamps and dates. Supports seconds and milliseconds, showing both UTC and local time.
- Format or minify JSON instantly. Everything runs in your browser — no data is uploaded.
- Convert between JSON and YAML — useful for config file format conversion and data inspection.