Decode a JWT

Decode a JWT header, payload and signature locally with base64url — no signature verification and nothing is uploaded.

Files stay local .txt Max 1MB
Paste a JWT (three-part token)Local decode only · signature not verified
Drag a file to load its contents
Supports .txt · Max file size: 1MB
Drag a .txt containing the JWT into the input

What this tool does

A JWT (JSON Web Token) is three base64url parts joined by dots: the header names the signing algorithm, the payload carries the claims (sub, exp, custom fields), and the signature lets the server verify it. This tool decodes the first two parts into readable JSON locally and shows the third as-is.

Decoding happens entirely in your browser: nothing is uploaded and no endpoint is called. Signatures are not verified — verification needs the secret key, which the holder of a token does not have; that job belongs to the server.

How to use

  1. Paste the token or drop a .txt The token looks like xxxxx.yyyyy.zzzzz; you can also drop a text file that contains it.
  2. Read the decoded output Header and payload expand into indented JSON while the signature stays as base64url; download the JSON if you need to keep it.
  3. Check exp first, then iss / aud Most "session expired" bugs are an expired exp, or iss / aud that disagree with the server. exp is Unix seconds — convert it with the timestamp tool.

FAQ

Does it verify the signature?

No. Verification requires the signing key, which a browser does not have. This tool decodes the format only; trust is decided by the server.

Is my token uploaded?

No. Decoding happens entirely in your browser and the token never leaves your device — still, avoid pasting production tokens into any online tool.

Why does decoding fail?

Three usual causes: not exactly three parts; a part that is not valid base64url (truncated or line-wrapped when copied); or a payload that is not JSON — some tokens are opaque references, not JWTs.

How do I read the exp claim?

exp is a Unix timestamp in seconds. Paste it into the timestamp converter to make it readable; mixing seconds and milliseconds is a classic source of bugs.

Is JWE (encrypted tokens) supported?

No. JWE is a five-part encrypted structure; this tool handles three-part JWS (signed tokens) only and reports a part-count error otherwise.

Can it mint or forge tokens?

No. It only decodes. Issuing tokens requires the key and belongs to the server; forging someone else’s token is neither possible nor appropriate.

Limits

Three-part JWS only: no five-part JWE (encrypted tokens), no signature verification, and no validation of exp / iss / aud claims.

The output is a decode result, not proof of validity; input files up to 1MB and nothing is uploaded.

Related tools