Skip to content
Esc

JWT decoder

Token never leaves this tab

Paste a JSON Web Token to read its header and payload as formatted JSON, with iat, nbf and exp turned into dates. Decoding happens in this tab, so the token never leaves your device.

Try:
Decoded in this tab only. Not saved, not sent, not put in the address bar.
Drop a .txt or .csv file here, or· read in your browser, never uploaded
Runs in your browser. Ctrl+Enter also works.

Fill in the fields to see the result.

How to use it

  1. Paste the token (a leading 'Bearer ' is removed).
  2. Read the algorithm, the claims and the times in UTC.
  3. Copy the decoded JSON or download it.

Details

Format
header.payload.signature, each Base64URL
Times
iat, nbf and exp shown as ISO 8601 UTC
Signature
Not verified: decoding needs no key, verification does

Questions

Does decoding a JWT mean it is valid?

No. Anyone can decode a JWT; the payload is only Base64URL. Trust it only after verifying the signature with the issuer's key, and checking exp, iss and aud.

Is it safe to paste a production token here?

The token is decoded in your browser and never sent, saved or added to the URL. Still, treat live tokens like passwords and prefer expired or test tokens.

Why does it say the token is expired?

The exp claim is a Unix time in seconds. If it is in the past, servers should reject the token. Check your clock and the token's lifetime.

Can it decode encrypted JWTs (JWE)?

No. A JWE has five parts and its payload is encrypted, so it can't be read without the key. This tool reads signed JWTs (JWS) with three parts.

Is my input sent anywhere?

No. It is processed by code running in this tab. Nothing is uploaded, logged or saved; tokens, hashes and text are never put in the page address.

Can an AI agent use this?

Yes. The same function is a tool on our free MCP server at tools.cuelark.com/mcp, so ChatGPT, Claude or Cursor get exactly the answer this page shows. 'Copy MCP call' gives you the arguments.