Web

JWT Decoder

Paste any JSON Web Token (JWT) to instantly decode the header and payload. Standard claims such as exp, iat and iss are highlighted. Decoding never leaves your browser, so it is safe to use with sensitive tokens.

token.jwtpaste a token below
runtime

Browser-local execution

Inputs stay inside the current tab unless you copy, download or explicitly export.

memory

Session handoff

Magic Paste can pass input to a target tool through sessionStorage, never through the URL.

control

User-owned state

Favorites, recent tools and workflow history are local browser data you can clear from the browser.

smart handoff graph

Suggested next moves

session handoff ready
/web
JWT Lab
Sign and verify HS256 JWTs locally, with decoded header and payload.
/time
Unix Timestamp Converter
Convert between Unix timestamps and human-readable dates.
/encoding
Base64 Encoder / Decoder
Encode text or files to Base64 and decode back, instantly.
/crypto
Secret Scanner
Detect leaked tokens, private keys, JWTs and high-entropy strings before you share text.
sponsor

Fixed native slots for developer products. No third-party tracking, no popups, no layout shift.

Sponsor this tool
01

How to use

  1. 01Paste a JWT (three Base64URL parts separated by dots) into the input.
  2. 02Header and payload are decoded and displayed as formatted JSON.
  3. 03Standard claims like exp and iat are translated to readable dates.
02

FAQ

Can this tool verify the signature?
Not yet. This tool decodes the token only. Verifying the signature requires the issuer's secret or public key, which is best handled by your backend library.
Is it safe to paste production tokens here?
Yes — decoding happens entirely in your browser using JavaScript. Nothing is sent over the network. Still, treat tokens as credentials and rotate any you have shared.
03

Related tools