Paste a JSON Web Token to decode its header and payload. This only decodes — it does not and cannot verify the signature (that needs the signing secret/key, which never leaves your server). Nothing here is sent anywhere; decoding happens entirely in your browser.
Paste a JSON Web Token and instantly read its header and payload — algorithm, issuer, subject, expiry, custom claims — with timestamps turned into readable dates so you can see at a glance whether a token has expired.
The decoder runs entirely in your browser: the token is never sent anywhere, which matters because a JWT is often a live credential. It does not verify the signature (that requires the secret or public key), it only decodes.
The token is decoded locally and never transmitted. Still, treat tokens like passwords — do not paste them into tools you do not trust, and prefer expired or test tokens when possible.
No. Signature verification needs the signing secret or public key; this tool only decodes the base64url-encoded header and payload.
A valid JWT has exactly three dot-separated parts. Check that you copied the whole string without a trailing "Bearer " prefix or line breaks.
Free, private, no account. Like every DevForge tool, this one runs in your browser and never uploads your files. See all 35 free tools or join the DevForge community to share your own games, tools and assets.