JWT Decoder
Decode a JSON Web Token's header and payload. Your token never leaves your browser.
This only decodes the token — it does not verify the signature. A token decoding cleanly here says nothing about whether it's authentic, unmodified, or was actually issued by who it claims. Never treat successful decoding as proof a token is valid or safe to trust.
Token
Decoded locally. Your token never leaves your browser.
Paste a JWT to decode its header and payload.
Header
Payload
Signature (not verified)
Raw signature bytes, shown as-is. This tool has no key/secret to check it against.
Common questions
If the header and payload decode without any errors, does that mean the token is valid?
No. Successful decoding only means the token is well-formed Base64URL-encoded JSON in the correct three-part structure — nothing about validity. A token can decode perfectly and still be expired, revoked, tampered with, or entirely fabricated with a fake signature. Only checking the signature against the correct key — which this tool never has — can establish that, and it does not do that check.
Why does "exp" show a fixed UTC time instead of my local time zone?
To avoid ambiguity. The raw claim is a Unix timestamp, and showing it as a fixed UTC string means it can't be misread as being in the token's own (unknown) time zone or silently reinterpreted as yours.
Can this tool tell me if a token is expired?
It can show what the exp claim says and whether that time has already passed — but that's just reading a number out of an unverified payload. If the token's signature isn't valid, the whole payload, including exp, could have been altered, so treat this as informational, not a security check.