// Paste a JWT to decode
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiaWF0IjoxNzA1MzEwOTAwLCJleHAiOjE5OTk5OTk5OTl9.dQw4w9WgXcQJWT Decoder
Decode the header, payload, and signature of a JSON Web Token. Decoding is local — your token is never sent to a server.
JWT
Decoded
Decoding is not verification.Anyone can decode a JWT — the signature is what proves authenticity. Verify signatures on the server.
Your input is processed locally and isn't uploaded for processing. Verify by opening DevTools → Network — there are no requests carrying your data.
JWT Decoder examples.
Frequently asked questions.
Is decoding the same as verification?
No. Decoding only reads the header and payload — it does not check the signature or prove authenticity. Always verify tokens on the server.
Is my JWT sent anywhere?
No. Decoding runs entirely in your browser. Do not paste tokens you do not own into third-party services.
What are registered claims?
The JWT spec defines standard claims like iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at), and jti (token id).
How do I read expiration?
The exp claim is a Unix timestamp in seconds. We compute the expiration date and check whether the token is expired.