JWT Decoder

The token never leaves your device

Developers paste production tokens into tools like this one. Ours decodes entirely in your browser using the platform's own base64 decoder - there is no API call, no logging, no analytics event carrying the token, and the page continues to work with your network disconnected. That property is covered by a test that fails the build if this page issues any network request during a decode.

It is worth being blunt about why that matters: a JWT is a bearer credential. Pasting one into a hosted decoder hands whoever runs it a live session, and most hosted decoders do not tell you which of the two kinds they are.

What you get

The header and payload are decoded and pretty-printed, and the registered claims are resolved into something readable: `exp` and `iat` and `nbf` rendered as real timestamps in your local timezone alongside the raw epoch values, plus an at-a-glance indication of whether the token is currently within its validity window. Custom claims are shown as-is, because guessing at their meaning would be inventing information.

Decoding is not verifying

This is the single most important thing to understand about JWTs, and the most common source of real security bugs involving them. A JWT's payload is base64-encoded, not encrypted: anyone holding the token can read every claim in it, including this tool, without any key at all. Decoding tells you what the token says. It tells you nothing about whether the token is genuine.

Verification is a separate operation that requires the signing key and must happen on your server, on every request, with the algorithm pinned. If your application trusts a claim it decoded without verifying the signature, an attacker can edit that claim freely - and never let the token's own `alg` header choose the verification algorithm, because that is exactly how the `alg: none` and RS256-to-HS256 confusion attacks work.

What it will not do

It does not verify signatures, and it never will - doing so would require you to paste your signing key into a web page, which is worse advice than anything this tool could save you. It also does not decrypt JWEs, which are genuinely encrypted rather than merely encoded, and it does not tell you whether a token has been revoked, because revocation state lives in your application, not in the token.