JWT

JWT Decoder

Decode a JSON Web Token's header and payload locally — no verification.

Your files stay on this device

Files are processed in your browser, never uploaded. The site downloads code and assets to run the tools. No accounts or trackers.

Use Download to save this tool as one HTML file for offline use.

Privacy →

paste token

Decoded locally — the signature is NOT verified. Never paste production secrets you do not trust.

header

—

payload

—

Try a worked example

Example

Paste the jwt.io sample token, which begins eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. The header shows the HS256 algorithm, the payload shows sub 1234567890 and iat 1516239022, and the dates panel reads iat as 2018-01-18T01:30:22.000Z.

Keep in mind

Decoding is not verification: anyone can create a token with any claims, so a server must check the signature and expiry before trusting it. Decoding here is local, but treat live tokens like passwords and paste them only where you need to.

About this tool

Paste a JSON Web Token to decode its header and payload and read the claims, with timestamp fields like exp and iat shown as readable dates. Decoding happens entirely in your browser — the token is never sent anywhere.

Frequently asked questions

Does it verify the signature?

No. It only decodes the Base64URL header and payload so you can inspect the claims. It does not check the signature.

Is my token safe?

Yes. Everything is decoded locally in JavaScript; the token never leaves your device.