JWT Decoder
Decode a JSON Web Token's header and payload — no signature verification, no network call.
This only decodes the token to show what it contains — it does not (and cannot, without the issuer's secret or public key) verify the signature. Never treat a decoded-but-unverified token as trustworthy.
Decoding happens entirely in your browser — the token is never sent anywhere.
Frequently asked questions
Does this verify the signature?+
No, and it can't — signature verification requires the issuer's secret or public key, which this tool never has. It only decodes the header and payload so you can inspect their contents, exactly like pasting into jwt.io's debugger view.
Is it safe to paste a real token here?+
Decoding happens entirely in your browser — the token is never sent to any server. That said, treat access/ID tokens like any other credential and avoid pasting production tokens into any web tool if your org's policy discourages it.
What are exp, iat, and nbf?+
Standard time claims: iat is when the token was issued, exp is when it expires, and nbf is 'not before' — the token isn't valid until that time. This tool converts any of these it finds into a readable date automatically.