About the JWT Decoder
Paste a token to see its algorithm, key id and every claim in a readable table. Expiry and issued-at timestamps are converted to local dates and flagged when they are in the past or future.
How to use it
- 1Paste the tokenThe three Base64URL segments are split and decoded automatically.
- 2Read the claimsHeader, payload and signature are shown separately, with standard time claims explained.
- 3Check the timingExpiry, not-before and issued-at values are compared against your current clock.
Why use this jwt decoder?
- Signature is not a secret check. Decoding is not verification. This tool never asks for a key and cannot tell you whether a token was signed by a trusted issuer.
- No upload wait. You skip the round trip to a server entirely. Results are limited by your own CPU, not by network speed or queue size.
- Free, no account, no quotas. No sign-up wall, no watermark, no daily limit. Optional accounts only exist to save favourites and presets across devices.
Frequently asked questions
Is my token safe to use here?
Yes. This tool runs entirely in your browser using JavaScript. Nothing you paste or open is sent to a server, and the page keeps no copy after you close it.
Do I need to create an account?
No. Every tool is fully usable without signing in. An account only adds saved favourites and reusable presets.
Does it work on a phone?
Yes. The interface is mobile-first with large touch targets and a stacked layout, so it works on phones and tablets as well as desktops.
Does decoding a JWT verify it?
No. Decoding only reads the Base64URL-encoded parts. Verification requires the issuer's key and must happen on your server. Never trust claims from an unverified token.
Why is the signature shown as binary?
The signature is a binary value encoded with Base64URL. It rarely contains readable text, so it is shown encoded and its byte length is reported instead.