Decode JSON Web Tokens to inspect the header, payload, and signature. Token never leaves your browser.
The signature is shown raw. This tool does not verify signatures — verification requires the secret or public key.
Paste your JWT into the input box above. The header, payload, and signature are decoded live as you type. Standard claims like iss, sub, aud, exp, iat, nbf, and jti are explained below the payload, and an "Expired" badge appears if the exp timestamp is in the past. All decoding happens in your browser — the token is never sent to a server.