Does this verify the JWT signature?

The tool decodes the header and payload but does not verify the cryptographic signature, which requires the issuer's secret or public key. Use it for inspecting claims, not for security validation. All decoding runs in your browser.

Is my JWT sent to a server?

All decoding happens in your browser using JavaScript. Our servers are not involved at any point.

What is Base64url encoding?

JWTs use Base64url, a URL-safe variant of Base64 that replaces + with - and / with _. This makes tokens safe to include in URLs without additional encoding.

Can I see the raw header and payload?

The raw token stays in the input box, where the header, payload and signature are the three dot-separated Base64url segments. The output shows the decoded header and payload as formatted JSON, in separate tabs.

JWT decoder

JWT decoder is a developer tool that decodes the header and payload of a JSON Web Token. It shows both parts as formatted JSON, converts the iat and exp claims to UTC dates, and tells you whether the token has expired. The tool runs in your browser.

JWT token

⚠ Signature not verified, client-side only

VIEW

Runs entirely in your browser

Dedicated pages

Direct links for each decoder view.

JWT decode and expiry check

Decode a JWT and check whether it has expired. See the time left or time since expiry, plus exp and iat as UTC dates. Runs in your browser.

JWT header decoder

Decode and inspect the header section of a JWT. See the algorithm (alg) and token type (typ) claims. Runs in your browser.

JWT payload claims explained

Decode and inspect the payload (claims) of a JWT. See user ID, roles, expiry, and any custom claims. Runs in your browser.

Decode JWT Token Offline

Decode a JWT token offline once the page has loaded, without uploading it. No account required. All decoding runs in your browser using standard JavaScript.

Decode JWT Token

Decode a JWT token and read the header and payload claims as formatted JSON, including custom claims your application adds. Runs in your browser.

JWT Payload Decoder

Decode and inspect the payload claims of a JWT in your browser. See user ID, expiry, roles, and custom claims. Runs in your browser.

How to decode a JWT

Paste your JWT token into the input area. It starts with ey and contains two dots separating three parts.
The header and payload are decoded and shown in separate tabs. The signature is not decoded or verified.
Inspect the claims in the payload, expiry time, issuer, subject, and custom fields.
Check whether the token has expired based on the exp claim.

Common uses

Inspecting the claims inside a JWT from an API response during debugging, use JSON formatter to pretty-print the decoded payload
Checking the expiry time of an authentication token to troubleshoot session issues. The Unix timestamp converter helps translate the exp claim to a readable date
Verifying the structure and contents of a JWT before implementing token handling

Technical specification

Algorithm or formula: Token is split on the two dots into header, payload, and signature segments. The header and payload segments are normalised from Base64url (- and _ become + and /, and padding is added), decoded with atob and parsed with JSON.parse, with JSON.rawJSON keeping integers beyond 2^53 exact where the browser supports it. The signature segment is not decoded. UTF-8 handling uses percent-encoded byte expansion to preserve non-ASCII claims.
Browser API or library: Native atob and JSON.parse. No external library.
Input limits: Any JWS-encoded token small enough for the browser to hold in memory.
Output: Decoded JSON header and payload, the iat and exp claims as UTC dates, and whether the token has expired.
Known limitations: Signature verification is not performed. Use this tool for inspection only; trust decisions need a server-side check against the signing key.

Frequently asked questions

Does this verify the JWT signature?: The tool decodes the header and payload but does not verify the cryptographic signature, which requires the issuer's secret or public key. Use it for inspecting claims, not for security validation. All decoding runs in your browser.
Is my JWT sent to a server?: All decoding happens in your browser using JavaScript. Our servers are not involved at any point.
What is Base64url encoding?: JWTs use Base64url, a URL-safe variant of Base64 that replaces + with - and / with _. This makes tokens safe to include in URLs without additional encoding.
Can I see the raw header and payload?: The raw token stays in the input box, where the header, payload and signature are the three dot-separated Base64url segments. The output shows the decoded header and payload as formatted JSON, in separate tabs.

Related tools

Background reading: Complete guide to developer tools

Reviewed and tested September 30, 2026.