JWT Decoder
Paste a JSON Web Token to instantly decode its header, payload, and signature directly in your browser. See issued-at and expiry times and catch expired tokens at a glance.
JWT Decoder features
Three-Part Decoding
Splits any JWT into its Header, Payload, and Signature so you can inspect each part separately.
Readable JSON Output
Decodes the Base64URL Header and Payload into clean, formatted JSON that is easy to scan.
Expiry Detection
Reads iat and exp claims, shows them as dates with relative time, and flags expired tokens.
Raw Signature View
Displays the signature exactly as it appears in Base64URL form, without altering it.
Fully Private
Decoding happens entirely in your browser. Your token is never uploaded or stored anywhere.
Instant Results
Tokens are decoded the moment you paste them, with no buttons or round trips to a server.
Overview
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It is made of three Base64URL-encoded parts joined by dots: header.payload.signature. The header describes the signing algorithm, the payload carries the claims, and the signature is used to verify the token's integrity.
This JWT Decoder splits a token into those three parts and decodes them for you. The Header and Payload are shown as readable, formatted JSON, while the Signature is displayed raw in its Base64URL form so you can inspect exactly what was signed.
It also reads standard time claims like iat (issued at) and exp (expiration) and converts them into human-readable dates with relative time, flagging any token that has already expired. This makes it easy to debug authentication flows and see what a token actually contains.
Crucially, a JWT is encoded, not encrypted. Anyone with the token can read its payload, so the tool simply decodes what is already readable — it never needs a secret or key to show you the contents.
How to use the JWT Decoder
- Copy your JSON Web Token from your app, API response, or browser storage.
- Paste the full token (header.payload.signature) into the input box.
- Read the decoded Header and Payload, shown as formatted JSON.
- Inspect the raw Base64URL Signature in its own section.
- Check the issued-at and expiry times, including the relative time and any expired flag.
- Copy any decoded section you need for debugging or documentation.
Good to know
Keep these caveats in mind when using the decoder:
- Decoding only, not verification. This tool does not check the signature. A token that decodes cleanly may still be invalid, forged, or revoked — only your backend with the correct key can verify it.
- Never paste your signing secret or private key. Verification requires the key, and pasting it into any web tool defeats its purpose. Verify tokens server-side instead.
- A JWT is not encrypted. The payload is readable by anyone who has the token, so never place passwords, secrets, or sensitive personal data inside it.
- Treat tokens as credentials. A valid, unexpired token can grant access. Avoid sharing real production tokens and prefer test tokens when debugging.
Private by design
Every byte you paste into the JWT Decoder is processed locally in your browser. Formatly makes no network request with your data, logs nothing, and stores nothing on any server — so it is safe for API responses, tokens, configuration and other sensitive content. Your most recent input and theme are saved only in your own browser's local storage.
JWT Decoder FAQ
Is it safe to decode my JWT here?
Yes. All decoding runs entirely in your browser using client-side code. Your token is never uploaded, logged, or sent to any server. That said, a JWT payload is only encoded, not encrypted, so anyone holding the token can read it — treat the token itself as a credential and avoid sharing it.
Does this tool verify the JWT signature?
No. This tool only decodes the token; it does not verify the signature. Verification requires the secret or public key, and you should never paste a signing secret into any web tool. The signature is shown raw so you can compare it, but its validity is not checked here.
Does the JWT decoder work offline?
Yes. Once the page has loaded, decoding works without an internet connection because everything happens locally in your browser. You can decode tokens with no network access at all.
What is the difference between decoding and verifying a JWT?
Decoding simply reverses the Base64URL encoding to reveal the header and payload — no key needed, since a JWT is not encrypted. Verifying uses the signing secret or public key to confirm the signature is valid and the token was not tampered with. This tool decodes; verification belongs in your server-side code.
Why is my token shown as expired?
The tool reads the exp (expiration) claim from the payload and compares it to the current time. If that timestamp is in the past, the token is flagged as expired. It also reads iat (issued at) so you can see when the token was created, both as a date and as relative time.
Can I decode an encrypted JWT (JWE)?
No. This tool handles standard signed JWTs (JWS), where the header and payload are Base64URL-encoded and readable. An encrypted token (JWE) cannot be decoded without the decryption key, so its contents will not display as readable JSON here.
Should I put secrets in a JWT payload?
No. Because a JWT is encoded, not encrypted, anyone with the token can read the payload — exactly as this tool demonstrates. Never store passwords, API keys, or other sensitive data in the payload. Use it only for non-secret claims like user IDs, roles, and expiry times.