How does offline JWT decoding work?

JWT tokens consist of three Base64URL-encoded sections separated by dots. Your browser decodes the header and payload sections using the built-in atob() function and JSON.parse(). The signature section is not decoded. Our servers are not involved at any point.

Why is it important to decode JWTs without uploading them?

JWT tokens often contain user IDs, session credentials, and role claims. Pasting a token into a server-based tool means the server operator can read all of that information. Decoding locally means the token is read in your browser. Our servers are not involved at any point.

How can I check that the token is not sent anywhere?

Open your browser DevTools, select the Network tab and paste a token: decoding adds no request to the list. The Check it yourself page at /verify-local shows your browser blocking a request the site tries to send, and its technical page explains the Content Security Policy (connect-src 'none') behind that.

Can I use this tool without an internet connection?

Yes, once the page has loaded. All decoding runs locally, so you can disconnect from the internet and the tool keeps working until you close or reload the tab or open another page. Opening or reloading the page needs a connection.

Decode JWT Token Offline

Decode and inspect a JSON Web Token entirely in your browser, with no internet connection required after the page loads. Paste your JWT and see the header and payload immediately. All decoding runs locally using standard JavaScript.

JWT token

⚠ Signature not verified, client-side only

VIEW

Runs entirely in your browser

How it works

A JWT consists of three Base64URL-encoded parts separated by dots. The tool splits the token, fixes URL-safe base64 encoding (replacing - with + and _ with /), pads to a multiple of 4 characters, then decodes the header and payload with atob() and parses them with JSON.parse(). The signature is not decoded. All of this runs in your browser. Our servers are not involved.

Processing runs in your browser

Your JWT is decoded entirely in your browser. Our servers are not involved at any point. Treat tokens as sensitive credentials and avoid pasting production tokens in shared or public environments. You can check this yourself in your browser's DevTools Network tab.

Technical specification

JSON Web Token (JWT) is defined in RFC 7519 (IETF, 2015). A JWT consists of three Base64url-encoded sections separated by .: header, payload, and signature. Base64url encoding is defined in RFC 4648 §5, which substitutes + with - and / with _ and omits padding, making it safe for use in URLs without percent-encoding. Signed JWTs (JWS) are specified separately in RFC 7515.

Structure: header.payload.signature (3 Base64url parts)
Standards: RFC 7519 (JWT), RFC 7515 (JWS), RFC 4648 (Base64url)
Header claims: alg (algorithm), typ (token type)
Common payload claims: sub, iss, exp, iat, aud

Related operations

To inspect the raw Base64 segments of a token, try Base64. For verifying the signing input by hash, use the hash generator. To pretty-print decoded payloads, see the JSON formatter.

Frequently asked questions

How does offline JWT decoding work?: JWT tokens consist of three Base64URL-encoded sections separated by dots. Your browser decodes the header and payload sections using the built-in atob() function and JSON.parse(). The signature section is not decoded. Our servers are not involved at any point.
Why is it important to decode JWTs without uploading them?: JWT tokens often contain user IDs, session credentials, and role claims. Pasting a token into a server-based tool means the server operator can read all of that information. Decoding locally means the token is read in your browser. Our servers are not involved at any point.
How can I check that the token is not sent anywhere?: Open your browser DevTools, select the Network tab and paste a token: decoding adds no request to the list. The Check it yourself page at /verify-local shows your browser blocking a request the site tries to send, and its technical page explains the Content Security Policy (connect-src 'none') behind that.
Can I use this tool without an internet connection?: Yes, once the page has loaded. All decoding runs locally, so you can disconnect from the internet and the tool keeps working until you close or reload the tab or open another page. Opening or reloading the page needs a connection.

Last reviewed September 30, 2026

Other pages for this tool

Related tools

Background reading: Complete guide to developer tools