DevToolsBox
All tools

JWT Decoder

Decode and inspect a JSON Web Token without sending it anywhere.

This decoder never verifies the signature, and your token never leaves your browser. Even so, avoid pasting production tokens into any online tool unless you understand the risk.

About this tool

A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The first two are ordinary JSON, base64url-encoded — which means they are readable by anyone, not encrypted. The signature is what proves the token was not tampered with.

This tool decodes and inspects. It does not verify the signature, because doing so would require you to hand over the signing secret or public key.

How to use it

  1. Paste the token into the box. A Bearer prefix is stripped automatically.
  2. Read the decoded header and payload.
  3. Check the claims table for expiry, issuer, subject and audience.
  4. Copy either segment as formatted JSON if you need it elsewhere.

Example

Token
eyJhbGciOiJIUzI1NiJ9.
eyJzdWIiOiIxMjMiLCJuYW1lIjoiSXNsYW0ifQ.
signature
Payload
{
  "sub": "123",
  "name": "Islam"
}

FAQ

Is my token sent to a server?
No. Decoding happens entirely in your browser, and this page contains no analytics or network calls. The token is never logged or transmitted.
Does this verify the signature?
No, and that is deliberate. Verification requires the signing key. A tool that asked you to paste your secret would be far more dangerous than one that does not.
Is it safe to paste a production token here?
The token stays in your browser, but a token is a live credential until it expires. Treat it like a password: prefer a test token, and rotate anything you have pasted into any online tool.
Why does it say the payload is not valid JSON?
Usually the token was truncated when copied, or a URL-encoded version was pasted. Copy the whole value again, including all three dot-separated parts.
What do exp, iat and nbf mean?
They are timestamps in seconds since 1970: exp is when the token expires, iat when it was issued, and nbf the earliest moment it may be accepted. This tool shows each as a UTC date with a relative description.