Decode a JWT without leaving the browser. JWT Decoder splits a JSON Web Token into its header, payload and signature and decodes the claims — useful when you need to inspect the header, claims and expiry inside a JSON Web Token between two other steps of a debugging session. Everything runs inside your browser, so the file never touches a server, which matters when the payload contains tokens, customer records or anything else you would not paste into an unknown server.
How to
Four steps, no account, nothing to install.
Drop in the full three-part token.
Check subject, audience, issuer and scope.
Confirm the expiry and issued-at values line up with the behaviour you are debugging.
Overview
A JWT is three Base64URL segments — header, payload and signature — joined by dots. The payload is encoded, not encrypted, so anyone holding the token can read its claims; only the signature check proves the token has not been tampered with.
Paste the token — Drop in the full three-part token. Read the claims — Check subject, audience, issuer and scope. Check the timing — Confirm the expiry and issued-at values line up with the behaviour you are debugging. The whole loop is designed to be repeatable: change the input, read the new result, no re-submit step in between.
The failures people hit are predictable: Payload is readable by anyone; Hard to revoke before expiry; Easy to misconfigure algorithms. Each of those shows up as a specific, fixable symptom rather than a vague error, which is exactly what this tool surfaces.
API authentication, Single sign-on, Short-lived access grants — these are the contexts where JWT shows up, and this page is the fast path between "I have a blob of input" and "I understand what it contains". Keep the tab open next to your editor and your terminal. Scope note: decodes and inspects claims; it does not verify the signature against your secret.
Features
Header and payload rendered as formatted JSON
Expiry and issued-at shown as readable dates
Algorithm and key id surfaced
Token never leaves the browser
Reference
| Property | Value |
|---|---|
| Format | JWT (JSON Web Token) |
| Extension | .txt |
| MIME type | application/jwt |
| Human readable | No |
| Typical use | API authentication |
Examples
Copy the raw payload out of the network tab, drop it in here, and read the result immediately — no curl round trip, no scratch file.
Paste the snippet from the diff to confirm what it evaluates to before approving the change.
Because processing is local, real payloads with real identifiers can be inspected without violating a data-handling policy.
Benefits
FAQ
1. Paste the token: Drop in the full three-part token. 2. Read the claims: Check subject, audience, issuer and scope. 3. Check the timing: Confirm the expiry and issued-at values line up with the behaviour you are debugging.
No. Everything runs inside your browser, so the file never touches a server — safe for tokens, staging payloads and customer data.
Yes, with no account, no rate limit and no paid tier.
A signed, Base64URL-encoded token carrying JSON claims. The payload is encoded, not encrypted, so anyone holding the token can read its claims; only the signature check proves the token has not been tampered with.
Payload is readable by anyone; Hard to revoke before expiry; Easy to misconfigure algorithms.
Decodes and inspects claims; it does not verify the signature against your secret.
Once the page has loaded, yes — the processing needs no network access.
Tools
Explore
Learn