JWT Decoder for Developers

See the header, payload and signature of a JSON Web Token without trusting a third party.

Tools for engineers who would rather not context-switch into yet another tab to validate a JWT or generate a UUID. Everything runs in your browser, your payloads never leave the machine, and the pages load fast enough that you can leave them open in a sidebar while you debug.

Open the JWT Decoder →

What it does for Web and API developers

How to use it

  1. Copy the full token (header.payload.signature) from your request, your session storage, or a server log.
  2. The header and payload are decoded in place; you do not need to base64-decode them yourself.
  3. Check the exp claim against the current time. If you need to refresh the token, copy the new one back into the same box.

Other tools Developers reach for

JSON FormatterMake a wall of JSON readable, and a malformed one diagnosable, in under a second.UUID GeneratorProduce v4 UUIDs in bulk, with the option to copy one straight to the clipboard.Base64 Encoder / DecoderRound-trip a string or a file between bytes and base64 without uploading either.URL Encoder / DecoderPercent-encode or decode URL components with the right rules per part of the URL.Unix Timestamp ConverterConvert epoch seconds or milliseconds to a human date and back, with timezone awareness.

Common questions

Does a successful decode mean the token is valid?

No. Decoding is base64url and anyone can do it - it proves nothing about who issued the token or whether it was tampered with. Verification needs the signing key plus a check of the algorithm, issuer and audience. Treat every claim on this page as an unverified assertion.

Why is my token rejected even though the payload looks correct?

The usual causes are a signature that no longer matches, an expired exp claim, a clock skew of more than a minute or two, or an algorithm the server refuses - alg: none is a well-known attack. The header is attacker controlled, so read it as a hint, never as a guarantee.

Where should I never paste a token?

Anywhere that is not your own machine. A production token is a live credential, and pasting it into a site you do not control is equivalent to publishing it. This decoder runs in your browser, but a screenshot of the decoded payload leaks the same claims an attacker would want.