Network & DevOps ToolkitJWT Decoder
Decode a JSON Web Token and inspect its header, payload and claims.
Paste a JWT to split it into its three segments and Base64URL-decode the header and payload. Everything runs locally — your token never leaves the browser.
JWT Decoder
Header & payload
See the signing algorithm, token type and every claim in the payload.
Standard claims
Read iss, sub, aud, exp, iat and nbf at a glance to debug auth flows.
Local only
Decoding is pure Base64URL — no network call, no logging, nothing stored.
Does this verify the JWT signature?
No — it decodes and displays the token. Decoding never proves authenticity; verify the signature with the issuer's key on a trusted server before trusting any claim.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and nothing is sent anywhere. That said, treat live access tokens as secrets and prefer expired or test tokens when possible.
What does the exp claim mean?
exp is the expiry as a Unix timestamp. Use the Unix Timestamp Converter to turn it into a human-readable date.
Related tools
- Base64 Encode / Decode — JWT segments are Base64URL.
- JSON Formatter — pretty-print the decoded payload.
- Unix Timestamp Converter — read the exp/iat claims as dates.
🔐 Private by design: every tool runs in your browser. DNS lookups go straight to Cloudflare's DoH resolver (1.1.1.1); nothing else is sent to any server, and nothing is logged.