JWT Decoder
Read JWT headers and claims privately. Inspect expiry dates without uploading tokens or trusting unverified signatures.
Processed locally in your browserPreparing token decoder…
How to use JWT Decoder
- Paste a token, optionally including the Bearer prefix, and decode it locally. Signed-token structures have three segments; encrypted JWE structures have five.
- Read the protected header and readable JSON payload. Registered time claims show UTC dates and unverified expiry/not-before status.
- Copy decoded JSON if needed, review warnings, and clear the token when finished. Never use this output to grant access or establish identity.
Useful things to know
This is decoding, not signature verification, authentication, authorization or decryption. Encrypted JWE payloads remain opaque; only their protected header and segment sizes are displayed. No keys, remote key URLs or JWKS are fetched. Unsupported unencoded payloads, malformed base64url/UTF-8/JSON, duplicate keys and excessive size/depth are rejected. Tokens are limited to 64 KB with bounded header/payload JSON. Claims remain untrusted even when their dates are in the future. Raw number literals are preserved; claim date display has millisecond precision. Nothing is uploaded or persisted.
Is JWT Decoder free, and how is my privacy handled?
Yes. JWT Decoder is free to use without registration. Tool inputs are processed in your browser rather than uploaded to our servers. Optional usage analytics follows your cookie preferences; it does not receive your files or tool inputs. Keep your browser updated and review results before sharing.