JWT Decoder
Decode a JSON Web Token's header and payload locally. The token never leaves your browser — no signature verification is performed.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}How to decode a JWT
- Paste your token. Add a JWT into the box.
- Read the claims. The header and payload are decoded and pretty-printed instantly.
- Check the dates. Expiry, issued-at and not-before claims are shown as readable dates, with an expired warning if applicable.
What happens to your token
Decoding is fully client-side — the token never leaves your browser tab. This tool decodes the header and payload only; it does not verify the token's cryptographic signature.
What this decoder supports
Common reasons to decode a JWT
- Inspect exactly what claims an access or ID token actually contains.
- Check whether a token has expired without making an API call.
- Debug an auth flow by comparing issued-at and expiry times.
- Confirm the audience or issuer claim before wiring up a client integration.
Frequently asked questions
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser tab; the token isn't sent to OpenToolkit.
Does this verify the token's signature?
No — it decodes the header and payload only. Use your auth provider's library or tooling if you need cryptographic signature verification.
Can I decode an expired token?
Yes — it's still decoded normally, with an expired warning shown based on the exp claim.
Is it safe to paste a real token here?
Nothing is sent over the network — decoding is entirely local to this browser tab.
What if the token is malformed?
An error message explains what's wrong, such as too few dot-separated segments, instead of failing silently.
Does it work with tokens using any signing algorithm?
Yes for decoding — the header and payload are just Base64URL-encoded JSON regardless of algorithm. Verification isn't offered here at all.
Last reviewed: August 2026