filetools
Browse ~/

Decode a JWT

Paste a JWT and see its header, payload, and expiry decoded instantly. This tool reads a token - it never verifies one, and says so plainly.

Decode a JWT

How it works

  1. Paste a JWT into the box (or start from the pre-filled example) - the three dot-separated parts are header, payload, and signature.
  2. The header and payload decode immediately as you type, along with a plain-English read on any expires/issued-at/not-valid-before claims.
  3. The signature segment is shown as-is - this tool has no key to check it against, so it is never marked valid or invalid.
Example output

Input (a JWT)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQyIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImV4cCI6MTcwNDA2NzIwMH0.c2lnbmF0dXJlLW5vdC12ZXJpZmllZA

Output

Header:  {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"user-42","name":"Ada Lovelace","exp":1704067200}
Expires (exp): 2024-01-01T00:00:00.000Z - expired

The real decoded header and payload for this exact token, computed the same way the live tool decodes yours - including the "exp" claim, which this one has already passed.

Frequently asked questions

Is my token sent anywhere?

No. The token is decoded entirely on your device, and nothing is sent to a server - there’s no upload step at all. Turn off your Wi-Fi after the page loads and it still works. That said, a JWT often carries real identity or session claims, so avoid pasting a live production token into any tool - including this one - if you don’t need to. This page loads 2KB of JavaScript, gzipped - about what your browser’s network tab will show for this page’s own scripts.

What do "alg" and "typ" in the header mean?

typ just labels the token’s type, almost always JWT. alg names the signing algorithm the issuer used - commonly HS256 (a shared secret) or RS256 (a public/private key pair). Neither field is checked or acted on by this tool - they’re shown exactly as decoded.

Does this verify the signature?

No, and this is the most important thing to understand about this tool. A JWT’s header and payload are just base64url-encoded text with no secret involved, so reading them back needs no key - anyone can decode them, which is also why a JWT should never be used to hold a secret directly. The signature exists specifically so a party holding the right key can confirm the token wasn’t tampered with. This tool has no key and makes no attempt to check it - the signature segment is shown as raw text, never labeled valid or invalid.

What does an expired token look like here?

If the payload has an exp claim, it’s shown with its real date and time alongside a plain “expired” or “not yet expired” label, computed against your device’s own clock at the moment you view it. The same treatment applies to nbf (not valid before) and iat (issued at) when present. These are Unix time in SECONDS, not milliseconds - a common source of off-by-1000x mistakes when checking one by hand, which is exactly what this decoding avoids.

What happens if I paste something that is not a valid JWT?

You get a specific message naming the real problem - wrong number of dot-separated parts, invalid base64url text, or a segment that decodes but isn’t valid JSON - rather than a blank result or a generic error.

Base64 Encode/Decode JSON Diff / Compare URL Encode / Decode

Files are processed locally in your browser and never uploaded. Read more on the privacy page.