JWT decoder
Decode a JSON Web Token to see its header, claims and when it expires. Tokens are keys to accounts, so this page decodes them in your browser and can’t send them anywhere.
Runs in your browser. Your files are never uploaded or stored.
Header
Payload
Times
Decoding doesn’t check the signature. Never trust a token’s contents without verifying it on your server.
Something not working, or missing an option?
How to use JWT decoder
- Paste a token (it starts with eyJ).
- Read the header and payload.
- Check when it was issued and when it expires.
Questions
Does this verify the signature?
No. Anyone can make a token that decodes; only your server, with the secret key, can tell if it’s genuine.
Are my files uploaded?
No. The tool runs inside your browser, and the page is blocked from sending data anywhere. You can check by turning off your internet connection: it keeps working.
Open-source parts
This tool uses only features built into your browser: no third-party code.