JWT Decoder
Decodes only — this does not verify the signature. Never trust a JWT's contents without verifying it against the issuer's key server-side.
Advertisement
Paste a JWT to see its header and payload instantly. You can paste the token on its own or the whole Authorization header. The decoder also reads the exp, nbf, and iat claims and tells you whether the token has expired, which is usually the first question after a 401.
This is decode-only. A JWT's header and payload are Base64URL-encoded JSON that anyone can read without a key. The signature is what proves the token wasn't tampered with, and checking it needs the issuer's secret or public key, which never touches this page.
Frequently asked questions
- Does this verify the JWT signature?
- No — decode only. Verifying a signature needs the secret (HS256) or public key (RS256/ES256) the token was signed with, and none of that exists on the client. Treat the decoded header and payload as untrusted display data, not proof the token is authentic or untampered.
- Why do I get an error instead of a decoded payload?
- The token needs at least two dot-separated segments (header and payload) that are each valid Base64URL-encoded JSON. The error names the segment that failed. A "Bearer " prefix, surrounding quotes, and line breaks are stripped for you, so the usual cause is a token that was cut off when it was copied. See the guide below for the full "malformed JWT" breakdown.
- Can I decode an expired token?
- Yes. The decoder shows exp, nbf, and iat as dates, and tells you whether the token has expired, isn't valid yet, or how long it has left. The check uses your device's clock, and servers usually allow a minute or two of skew, so a token that expired seconds ago may still be accepted. An expired token still decodes normally; only the server that verifies it will reject it.
- Is my token uploaded anywhere?
- No. Decoding happens locally in your browser tab — the token is never sent to a server.
Read the full guide for this tool →
Related tools & guides
Part of JWT Tools & Guide
Advertisement