JWT Decoder
Decode a JSON Web Token to read its header and payload. Runs entirely in your browser — your token is never uploaded or logged.
- ✓ Runs in your browser — nothing uploaded
- ✓ No sign-up
- ✓ Free, no limits
Decoded locally in your browser — the token is never sent anywhere. The signature is not verified: decoding shows the claims, it does not prove they are authentic.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}This free JWT decoder shows you exactly what a JSON Web Token contains. Paste a token and its three parts — header, payload and signature — are split apart and the header and payload are decoded from base64url into readable JSON instantly. It is the fastest way to check what claims a token carries: the subject, issued-at and expiry times, scopes, roles or any custom fields your API added.
Crucially, this tool decodes but deliberately does not verify the signature — and it does everything locally in your browser. Most “JWT decoder” pages send your token to their server; this one never does, which matters because a JWT is a live credential. Anyone holding it can often act as the user until it expires, so pasting a production token into a site that uploads it is a genuine security risk. Here you can decode with your network disconnected and confirm nothing leaves the page.
Worked example: the standard sample token decodes to a header of {"alg":"HS256","typ":"JWT"} and a payload naming the subject 1234567890 and user John Doe. Copy either section with one click to drop into a bug report or test.
Frequently asked questions
Does this verify the JWT signature?
No. It decodes the header and payload so you can read the claims, but it does not check the signature — verification needs the secret or public key and should happen on your server, never in a public web tool.
Is it safe to paste my token here?
Yes — decoding happens entirely in your browser and the token is never transmitted or stored. You can disconnect from the internet and it still works. Still, treat any token as a live credential and avoid tools that upload it.
Why can anyone decode a JWT without a password?
A JWT's payload is only base64url-encoded, not encrypted — it is readable by design. The signature protects against tampering, not reading, so never put secrets in a JWT payload.