Encoders & Decoders
JWT Decoder
Decode a JWT header and payload locally, inspect standard claims, and see when exp, nbf, and iat fall. Signatures are not verified.
Processed locally. Nothing from the editor is stored.
How to use JWT Decoder
A JWT is three Base64url segments. This page decodes the first two as JSON and shows the signature segment unchanged. It does not check the signature, the issuer, or the audience. Treat the contents as untrusted claims.
- Paste the full token, including both dots.
- Choose Decode. The warning stays visible after a successful decode.
- Read the header, payload, and claim descriptions. Expiration is shown in UTC and as a relative time.
Examples
Inspect an access token before logging it
You can see exp and sub without sending the token to a website. Clear the field when you are done. The value is not written to local storage.
Notice alg none
A header with alg set to none adds a second warning. Decoding still does not make that token trustworthy.
Questions
Does this verify the signature?
No. Verification needs the issuer's key and is intentionally not attempted. A decoded payload can still be forged.
Where does the token go?
It stays in the page's memory. It is not stored in local storage and it is not included in analytics.