JWT Decoder
Paste a JSON Web Token to see its decoded header and payload. Decoding happens entirely in your browser — the token is never sent anywhere.
About this tool
A JWT's header and payload are only Base64URL-encoded, not encrypted, so anyone can read them without a key; never put secrets in a token's payload. Paste a token (a leading Bearer is ignored) to see the decoded header and payload, plus a plain-English list of the claims. The timestamps exp, nbf and iat are shown as real dates, and an expired token is flagged.
To check the signature, enter the shared secret for HMAC tokens (HS256, HS384, HS512), ticking the Base64 box if your secret is stored that way. For RSA and elliptic-curve tokens (RS256, PS256, ES256 and their 384 and 512 versions), paste the issuer's public key as a PEM block or a JWK; you'll often find it at the issuer's /.well-known/jwks.json address. A token with "alg": "none" has no signature at all and is flagged as untrustworthy. Everything runs in your browser and the token is never sent anywhere.