JWT Decoder Developer
Decode a JSON Web Token to read its header and payload — locally, always.
JWT Decoder is a free online tool that decode a JSON Web Token to read its header and payload — locally, always. It runs entirely in your web browser using plain JavaScript, so files are processed on your own device and never uploaded to a server. There is no sign-up, no file size limit imposed by the site, no watermark and no paid tier.
- Price
- Free — no account, no quota, no watermark
- Category
- Developer
- Where it runs
- In your browser, on your device
- Files uploaded
- None
- Technology
- plain JavaScript
- Settings
- None — it just works
- Works offline
- Yes, after the first visit
About JWT Decoder
A JWT is three Base64url segments separated by dots: header, payload and signature. The first two are encoded, not encrypted — anyone holding the token can read them. That is exactly why decoding a live token on someone else's server is a bad habit, and why this one runs entirely in your browser.
How to use it
- Paste the text you want to run through jwt decoder.
- There is nothing to configure — the result updates as you type.
Under the hood
| Runs on | plain JavaScript — runs the whole thing |
Questions
Does this verify the signature?
No, and it cannot — verification needs the signing secret or public key, which you should never paste into a web page. Decoding shows you what the token claims; verification proves the claim was not tampered with, and belongs in your application.
Is it safe to paste a production token here?
Safer than any server-side decoder, because nothing is transmitted. It is still a live credential on your clipboard, so treat it with the same care you would a password.
What do the exp and iat fields mean?
Both are Unix timestamps in seconds. `iat` is when the token was issued, `exp` when it stops being valid. This tool converts them and tells you whether the token has already expired.