JWT decoder
Decodes a JSON Web Token's header and payload locally in your browser. Decoded does not mean verified.
1 · Input
Nothing is sent to a server - the token never leaves this browser tab, is never stored, and is never logged.
What this does
Splits a JSON Web Token into its three segments and decodes the header and payload from Base64URL - showing the algorithm, standard claims (iss, sub, aud), and iat/nbf/exp as readable times with expiry state.
Decoded does not mean verified
This never checks the signature - a JWT's payload is Base64URL-encoded, not encrypted, so anyone can decode it without a key. Verifying that a token was genuinely issued by who it claims requires the actual signing key, which this tool never asks for or has. A token with alg: none is flagged - never treat that as secure.
Privacy
The token never leaves this browser tab - it is not sent to a server, not stored, and not logged.
