JWT Decoder — Free, Private, No Upload
Decode any JWT in your browser. Inspect header, payload, and signature — plus what the token actually does, its inferred type, and security warnings. Nothing is uploaded.
Paste a JWT above to decode it. Everything runs in your browser.
How it works
- Paste your JWT — Drop or paste any JWT. It is parsed entirely in your browser — nothing is uploaded.
- Inspect header, payload, signature — We split the three base64url parts, decode header and payload to JSON, and explain what each standard claim means.
- Read the type, expiry, and warnings — We infer whether it is an access / id / service token, show human-readable timestamps, and flag risks like alg:none, expired, or sensitive data.
Frequently asked questions
Frequently Asked Questions
Is my JWT uploaded to a server?
No. Decoding runs entirely in your browser via JavaScript. The server never receives your token. We do not log, store, or share anything.
Decode vs verify — what is the difference?
Decoding reads the base64 content (anyone can do it; the payload is not encrypted). Verifying checks the signature against a secret or public key to prove the token was not tampered with. A decoded-but-unverified token could be forged.
Why does my token show a security warning?
We flag common risks: alg:none (no signature), expired (exp in the past), not-yet-valid (nbf), sensitive data (email/password/keys) in the payload, or a token with no exp. These are things to investigate, not necessarily bugs.
How do you infer the token type?
From the claim set: email/email_verified/sub suggest an OIDC ID token; scope/client_id/aud/exp suggest an OAuth access token; iss+scope+RS256+no-sub suggests a service-account assertion. We show the inference and its reasoning so you can judge.
Is there a length limit?
No hard limit, but JWTs with large x5c certificate chains may slow rendering. Everything stays in your browser memory.
Can I verify the signature here?
This tool decodes (reads) the token. Signature verification needs the secret (HMAC) or public key (RSA/ECDSA) and is on the roadmap. Meanwhile, never trust a decoded-only token for authorization.