JWT Decoder
Paste a token to see its header, payload and claims. Decoding happens entirely on your device.
Header
Payload
Claims
The signature is not verified: that needs the issuer's secret or public key, which you should never paste into a website.
How it works
A JWT is three Base64URL-encoded parts separated by dots: a header, a payload and a signature. Paste the token (a leading Bearer is fine) and the first two parts are decoded and pretty-printed.
Time claims such as exp (expiry), iat (issued at) and nbf (not before) are shown as dates with a relative time, and the status line tells you whether the token has expired or is not valid yet. Tokens with alg: none are flagged because they carry no signature.
Because tokens often grant access to real accounts, this decoder never sends them anywhere. Even so, treat production tokens like passwords and prefer test tokens when debugging.
Questions
Does this verify the signature?
No. Verification needs the issuer's secret or public key. Decoding only shows what the token claims.
Is it safe to paste a real token?
The token stays in your browser, but anyone who sees your screen could reuse it until it expires. Revoke it if in doubt.
Why can't the payload be decoded?
The token may be encrypted (JWE, five parts) or truncated. Only signed tokens (JWS) have a readable payload.