Tools / Encode & decode / 05

JWT decoder

Runs locally · nothing uploaded

Read a JWT's header, payload and expiry in plain language, and verify the signature with your own key.

Times in

Encoded token

■ Header■ Payload■ Signature (dotted)

Decodedbase64url → JSON

Paste a token. It is decoded here as you type, without leaving this tab.

How it works

The token is split at its dots and each part is base64url-decoded in this tab. Nothing is sent to a server, which matters because a valid token is a credential.

Decoding does not prove who signed a token. Verification uses Web Crypto with the secret or public key you paste, and checks the signature only: whether the token is still valid is shown separately.

Times are NumericDate values (seconds since 1970) and are shown in your zone or UTC.

Shortcuts

Ctrl↵: Run
C: Copy the result (outside the editor)
CtrlK: Jump to another tool
?: All shortcuts