Paste a JSON Web Token to decode its header and payload and read the claims. Decoding happens entirely in your browser — your token is never sent anywhere.

The JWT Decoder decodes a JSON Web Token into its header and payload so you can read the claims, the issued-at and expiry times, and check whether the token has expired. Decoding runs entirely in your browser — your token is never sent to a server. It does not verify the signature.
No. It only decodes the token to show its contents. A JWT’s authenticity must be verified on your server using the secret or public key — never trust decoded claims without verifying the signature.
No. Decoding happens entirely in your browser; the token never leaves your device.