Decode a JSON Web Token
Paste a JWT to read its header and claims, with timestamps rendered as dates and expiry checked against now. Decoding happens in your browser and nothing is transmitted.
—
—
Header
Payload
Registered claims
Two things this does not do
It does not verify the signature. Doing that needs the signing secret (HS256) or the issuer’s public key (RS256/ES256). A token that decodes cleanly may still be forged — decoding proves only that it is well-formed, never that it is trustworthy.
Be careful where you paste real tokens. This page decodes locally and transmits nothing, and you can confirm that in your browser’s network tab. But a JWT is a live credential: as a habit, treat any online decoder as untrusted and use production tokens only in tooling you control.
Check something else
Found something you’d rather not fix yourself?
Configuring DNS, TLS and email authentication properly — without breaking live traffic — is part of our cybersecurity and managed services work.