JWT decode
Show a JWT’s header, payload and readable issue, start and expiry times without checking the signature.
Process locally
Files stay in this browser session. Closing or clearing releases them.
Add text
Type or paste the text to process
Adjust settings
Nothing to set; defaults work
This tool has no settings.
Run
Processes in this browser; cancel at any time
About this tool
Decode a JSON Web Token (JWT) to read its header and payload as formatted JSON. It helps when you are debugging a login or an API call and need to see which user or permissions a token carries, or whether it has already expired. The issue, start and expiry times (iat, nbf, exp) are also shown as readable dates.
Paste the token on its own or with its “Bearer ” prefix; up to 1 MB is accepted. Decoding does not check the signature, so the result always says “verified”: false. It runs in your browser, and the token is not uploaded.
How to use it
- Paste the JWT into the text box, or select Use example to load a sample token.
- There are no settings to adjust. Select Run.
- Preview jwt.json: it holds the header, the payload, readable times under “claims” and the signature part. Download it if you want to keep it.
Formats and limits
- Input
- Text
- Output
- JSON
- Size limit
- 1 MB
- Privacy
- Files stay in the current browser session. No file bytes are uploaded.
- Price
- Free, no sign-up
Common questions
Does decoding prove that the token is genuine?
No. Decoding only reads the Base64URL-encoded header and payload, which anyone can create or edit, so the result always shows “verified”: false. To check the signature with a secret, public key, certificate or JWK, use the JWT verify tool.
How can I tell whether the token has expired?
Look at “claims” in the result: expires_at, issued_at and not_before give the exp, iat and nbf times as UTC dates in ISO 8601 format, and expired is true once the exp time is reached by your device’s clock. Times the token does not contain are left out.
Can I paste the whole Authorization header?
A leading “Bearer ” prefix and surrounding spaces are removed automatically, so “Bearer eyJ…” works. Remove “Authorization:” and anything else before the token yourself.
Why is my token rejected?
The text must be a compact JWT of three parts separated by dots, whose header and payload decode to JSON, and the payload must be a JSON object. Encrypted tokens (JWE, five parts) cannot be decoded here.
Is my token sent anywhere?
No. Decoding runs in your browser and the tool makes no network requests. Still treat tokens like passwords: anyone holding a valid one can use it until it expires.
Related tools
JWT sign
Sign a JSON payload as a JWT with HS, RS, PS, ES or EdDSA algorithms, optionally adding issue and expiry times. Secrets and private keys are a separate input and are never saved with workflows.
JWT verify
Check a JWT’s signature with a secret, public key, certificate or JWK, and optionally its expiry and start times. Unsigned tokens and HMAC tokens checked against a public key are rejected.
Certificate decoder
Read PEM certificates and certificate requests: subject, issuer, validity, alternative names, public key, key usages, other extensions and fingerprints.
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.
Symmetric encryption (AES, SM4, DES)
Encrypt or decrypt text with AES (CBC, ECB, CTR, CFB, OFB or GCM), SM4, DES, Triple DES, Blowfish, RC2, RC5, RC6, RC4, Rabbit or XOR. The key is a separate input and is never saved with workflows.