🔑 Auth Tool
JWT Decoder
Decode JWT headers and payloads instantly in your browser. Inspect claims, check expiry, and view token structure — your token never leaves your machine.
Is it safe to paste a JWT into this tool?
Yes. All decoding happens in your browser using JavaScript. No data is sent to any server. You can verify this by opening your browser's Network tab — you'll see zero outbound requests when you decode a token.
Does this tool verify JWT signatures?
No. Signature verification requires the signing key, which should never be pasted into a web tool. This tool decodes the header and payload for inspection only. Always verify signatures server-side in your application.
What JWT claims does this tool show?
It shows all standard registered claims (iss, sub, aud, exp, nbf, iat, jti) with human-readable descriptions, plus any custom claims in the payload. Expiry and not-before timestamps are converted to local time with a relative countdown.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format used to transfer claims between parties. It consists of three Base64URL-encoded parts separated by dots: header (algorithm and type), payload (claims), and signature (integrity verification).