Free, runs entirely in your browser — no sign-up, no file upload to a server.
What does JWT Decoder do?
It decodes a JSON Web Token (JWT) and displays its header and payload as readable JSON, plus plain-language insights for the alg header and the exp/iat/nbf timestamp claims (when present).
How do I use it?
Paste a JWT (or load one of the labeled synthetic examples) and its decoded header, payload, expiration/issued-at/not-before status, and algorithm appear instantly. You can copy the full token or any decoded section, or send the header/payload to another tool.
Does this verify the token's signature?
No. The tool only decodes the token locally — it never checks the signature, so it can't tell you whether a token is authentic or will be accepted by any server. This is true even for tokens that use a normal algorithm like HS256 or RS256.
What does the alg: "none" warning mean?
alg: "none" means the token has no cryptographic signature at all. The tool shows a visible warning in that case because such a token must never be trusted as authenticated.
What do the expiration and not-before statuses mean?
If exp is present and in the past, the token shows as Expired; if it's in the future, it shows as Not expired. If nbf is present and in the future, the token shows as Not yet valid. These statuses only describe the decoded claims — they don't prove the token is genuine, and a missing claim isn't treated as pass or fail either way.
What happens if I paste an invalid token?
You'll get a specific error — for example, the wrong number of segments, invalid Base64URL encoding, or invalid JSON in the header or payload — and your pasted text is preserved so you can fix it without retyping.
Is my input sent anywhere?
Everything runs in your browser — nothing you type or paste is sent to a server, logged, or analyzed.
Is this safe to use with real tokens/secrets?
The decoding happens entirely in your browser, so a token you paste in is never sent to a server — but as a general precaution, avoid pasting production tokens into any third-party tool when you can test with a dummy value instead. The tool never asks for signing secrets or private keys.
How do I report a problem or request a feature for this tool?
Use the Contact / Feedback page — select "JWT Decoder" as the related tool so we know exactly which tool you mean, then describe the bug or the feature you'd like to see.