JWT Decoder | View Header & Payload in Your Browser (No Signature Verification)
Paste a JWT (JSON Web Token) to instantly decode and view its header and payload. This tool does not verify signatures. Everything runs in your browser only — your token is never sent anywhere.
This tool only decodes and displays a JWT. It cannot verify the signature (verification requires a secret or public key, which this tool does not accept).
The JWT you enter is processed entirely in your browser and is never sent anywhere.
Decoded result
Enter a JWT to see its header and payload instantly.
Header (JOSE Header)
Payload (Claims Set)
Date claims (human-readable)
Signature
The signature is not verified. This is simply the raw signature part as a string.
How to use
- Paste your JWT string (header.payload.signature format) into the input box.
- The header and payload are instantly decoded and shown as JSON. If exp, iat, or nbf are present, they're also shown as human-readable dates.
- Use "Copy header" or "Copy payload" to copy the decoded JSON to your clipboard.
How it works
About this tool
This tool decodes and displays the header and payload of a JWT (JSON Web Token, RFC 7519) entirely in your browser. It does not verify signatures. Verifying a signature requires a secret key or public key, and this tool is not designed to accept either. As a decode-only tool, it covers the same scope as the decoder portion of jwt.io.
JWT structure
A JWT is a string made of three parts — header.payload.signature — joined by . (period) characters. Each part is base64url-encoded (a URL/HTTP-header-safe variant of base64 where + becomes -, / becomes _, and no = padding is added).
Decoding steps
- Split the input into 3 parts by
.(an error is shown if there aren't exactly 3 parts). - Base64url-decode the 1st (header) and 2nd (payload) parts and reconstruct them as UTF-8 strings.
- Parse each reconstructed string as JSON.
- The 3rd (signature) part is shown as-is, as a plain string — it is neither decoded nor verified.
Human-readable date claims
If the payload contains exp (expiration time), iat (issued at), or nbf (not before) as numeric values (NumericDate — seconds elapsed since 1970-01-01T00:00:00Z), they are converted to human-readable dates and shown alongside the raw values. If exp is earlier than the current time, a note is shown indicating the token has expired — this is purely an informational display and does not constitute signature verification.
About signature verification
This tool does not verify signatures. Properly verifying a JWT's signature requires the secret key used by the issuer (for HMAC-based algorithms) or the corresponding public key (for RSA/ECDSA-based algorithms). This tool is intentionally scoped to not accept such key material, limiting it to inspecting the header and payload contents.
FAQ
Can this tool verify the signature?
No. This tool only decodes and displays the JWT's header and payload — it does not verify the signature. Verifying a signature requires a secret or public key, and this tool is not designed to accept either.
Is my JWT sent anywhere?
No. All decoding happens entirely in your browser. No data is ever sent to any server.
What are exp, iat, and nbf?
These are standard JWT claims defined by RFC 7519, expressed as UNIX time (seconds elapsed since 1970-01-01T00:00:00Z). exp is the expiration time, iat is when the token was issued, and nbf is the time before which the token should be considered invalid. This tool converts these to human-readable dates alongside the raw values.
What is a JWT?
A JSON Web Token (JWT, RFC 7519) is an industry-standard format for exchanging claims (pieces of information) as JSON, commonly used for authentication and authorization. It's represented as a string of three base64url-encoded parts — header, payload, and signature — joined by periods.
It shows "expired" — does that mean the token can't be used?
The "expired" note is simply a comparison between the payload's exp claim and the current time as shown by this tool — it is not the result of verifying the token's signature. Whether a token is actually valid depends on the issuing server's own verification.
Related tools
- Base64 Converter — Encode & Decode TextEncode text to Base64, or decode Base64 back to text — with correct handling of emoji and other multi-byte UTF-8 characters. Supports the URL-safe variant for JWTs and URL parameters. Everything runs in your browser; nothing is ever sent anywhere.
- CSV Column EditorExtract, reorder and merge CSV columns. Combine "First name" and "Last name" into a single "Full name" column, or reshape a contact list before importing it elsewhere. Everything runs in your browser — your data is never sent anywhere.
- CSV ⇔ JSON ConverterConvert between CSV and JSON in either direction. Use dot notation in column headers (like user.name) to represent nested objects and arrays. Everything runs in your browser — your data is never sent anywhere.
- Kanji Numeral & Daiji Converter (Japanese)This tool converts numbers into Japanese daiji (壱, 弐, 参…, the formal anti-fraud numerals used on gift envelopes, contracts and receipts) and standard kanji numerals (千二百三十四…). It's specifically for Japanese-language numeral conventions. Everything runs in your browser — nothing is ever sent anywhere.
- All tools