JWT Decoder
Read the header and payload of a JSON Web Token.
Decoding a JWT does not verify its signature. Anyone can read — or forge — the contents of an unverified token. Only your server, holding the secret or public key, can confirm a token is authentic.
Private by design. This tool runs entirely in your browser. Your input is processed on your own device and is not uploaded by DO101.
About the JWT Decoder
Paste a JWT to see its decoded header and payload, with timestamps rendered as readable dates and expiry highlighted. Decoding does not verify the signature — DO101 says so plainly rather than implying the token is trustworthy.
How to use it
- 1Paste the JWT.
- 2Read the decoded header and payload.
- 3Check the expiry banner for iat, nbf and exp.
What you get
- Header and payload decoded as formatted JSON
- iat, nbf and exp shown as local dates
- Expiry warning when the token is stale
- Standard claim explanations
- Decoded in your browser — tokens are never transmitted
Frequently asked questions
Does this verify the token?
No. Decoding a JWT does not verify its signature. Anyone can read or forge the payload of an unverified token — only your server, holding the secret or public key, can confirm it is authentic.
Is it safe to paste a real token here?
The decoding happens locally and nothing is sent to DO101. Even so, treat live tokens like passwords and avoid pasting production credentials into any website.
Keep going
People who use this tool usually reach for these next.
Encode or decode Base64 text and files, Unicode-safe.
Beautify, minify and validate JSON with error positions.
Convert between Unix timestamps and human dates.
Generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes.