JWT Decoder
Decode a JSON Web Token and read its header, payload and expiry.
Registered claims
About the JWT Decoder
Paste a token and see the header, the payload and every claim laid out in a readable table, with timestamps converted to real dates and a clear warning when the token has expired.
Decoding happens entirely in your browser. That still does not make it safe to paste a live production token into any website — including this one — because a valid token is a working credential until it expires.
Frequently asked questions
Does this verify the signature?
No. Verification needs the secret or public key, which must stay on your server. This tool only decodes what the token says.
Is a JWT encrypted?
No. The payload is Base64-encoded, not encrypted — anyone holding the token can read it. Never put passwords or secrets in a JWT.
Related tools
All Developer →SQL Formatter
Format a messy SQL query into readable, indented lines.
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text.
Text Diff Checker
Compare two texts and see exactly what was added, removed or kept.
.htaccess Redirect Generator
Build redirect, HTTPS, www and caching rules for Apache.
Image to Base64
Convert an image into a Base64 data URI for CSS, HTML or JSON embedding.
URL Encoder / Decoder
Percent-encode or decode URLs and query string components.