JWT Decoder
Decode JWT tokens online: inspect the header and payload claims with human-readable exp and iat timestamps. Decoding only — nothing is verified or uploaded.
This tool runs entirely in your browser. Your data never leaves your device — it is not uploaded to any server.
How to use
- 1Paste the JWT (the three dot-separated parts) into the input box.
- 2Read the pretty-printed header and payload, with exp/iat shown as real dates.
- 3Fix your token or its server-side verification accordingly — copy the payload if needed.
JWT Decoder
Paste a JSON Web Token and instantly see its three parts separately: the header (algorithm and token type), the payload (the actual claims) and the signature. Both JSON sections are pretty-printed, and timestamps like iat, nbf and exp are translated into plain dates in your locale, with exp marked as expired or still active.
Everything is decoded locally with Base64URL — the token is never sent anywhere and never verified. Remember: decoding shows what a token says, not what it is allowed to do. Signature verification always requires the secret or public key on a trusted system.
Frequently asked questions
Does decoding a JWT verify it?
No. Decoding is just Base64URL + JSON parsing and anyone can do it — including an attacker. A valid-looking decoded token proves nothing. Verification requires checking the signature with the secret (HMAC) or public key (RSA/EC), which needs the token issuer's key material.
Can you recover or change a token's claims?
You can read the claims, but you cannot forge a new token with modified claims without invalidating the signature — any change to header or payload breaks the signature check on the server.
Is it safe to paste a real token here?
The token is decoded entirely in your browser and never leaves your device — there is no upload. Still, treat tokens as credentials and avoid pasting production tokens anywhere you do not need to.
Related tools
Base64 Decoder
Decode Base64 back into readable text with proper UTF-8 handling — data URIs, API payloads and encoded config values become clear instantly. Private and free.
All tools →
Hash Generator
Compute SHA-1, SHA-256, SHA-384, SHA-512 or MD5 hashes of text or files, right in your browser. Fast checksums for integrity checks — nothing uploaded.
All tools →
SHA-256 Generator
Calculate SHA-256 hashes of text or files online using native WebCrypto — the standard choice for integrity checks and fingerprints. 100% client-side.
All tools →
JSON Formatter
Format and beautify messy JSON online — 2 spaces, 4 spaces or tabs, with instant validation and precise error locations. 100% in your browser.
All tools →
Embed this tool
Put this tool on your own site with one line — it runs entirely in the visitor's browser.
<iframe src="https://zoyku.com/en/tools/jwt-decoder?embed=1" width="100%" height="640" style="border:0;border-radius:16px" title="Zoyku — jwt-decoder" loading="lazy"></iframe>