About the JWT Decoder
JWT Decoder is a free browser-based developer tool from Convertify. Paste a JSON Web Token to instantly decode its header and payload, plus see when it was issued and when it expires. Everything runs instantly with no file upload, no account, and no usage limit.
Frequently Asked Questions
Does this verify the JWT signature?
No — it only decodes the header and payload, which is just Base64 and doesn't require the secret key. Verifying a signature requires the issuing server's secret or public key, which this tool never asks for.
Is it safe to paste a real production token here?
The token is decoded entirely in your browser and never sent anywhere, so it's as safe as viewing it in your browser's dev tools — but as with any tool, avoid pasting tokens for systems you don't control into third-party sites unnecessarily.
Why does it say my token is invalid?
A JWT must have exactly three dot-separated Base64url-encoded parts (header.payload.signature). If a part is missing, truncated, or not valid JSON once decoded, decoding will fail with a clear error.
What do the "Issued" and "Expires" lines mean?
They read the standard `iat` (issued-at) and `exp` (expiration) claims from the payload, if present, and show whether the token has already expired based on your current system clock.