LessInAILessInAI home

JWT Decoder

Decode JWT headers and payloads locally — no signature verification.

Runs locally in your browser. Your input is not uploaded or stored. You can verify this in your browser’s network panel.

This page handles sensitive data (tokens, keys, credentials). Decoding is local, but never paste secrets into a device or browser you do not trust.

What does this tool solve?

A JSON Web Token is three Base64URL segments — header, payload, signature — joined by dots. Decoding reads the header and payload; it does NOT verify the signature, so a decoded token is not a trusted token.

What examples should you start with?

Token structure

Input

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE3MzcwMDAwMDB9.signature

Output

Header: {"alg":"HS256"} · Payload: {"sub":"123","exp":1737000000}

Expiry claim

Input

exp: 1737000000

Output

2025-01-16T06:40:00.000Z — shown as valid or expired against the current time

How does it work?

The first two segments are Base64URL-encoded JSON. The decoder converts them back to text and parses the JSON — a purely local, reversible operation.

The third segment is the signature. Verifying it requires the issuer's secret or public key and a cryptographic operation; this tool deliberately does not attempt it, and labels the signature as unverified.

What are the edge cases and limits?

  • exp, iat, and nbf are NumericDate values: seconds since the Unix epoch, not milliseconds.
  • A token can be structurally valid yet useless — expired, wrong audience, or signed with a weak key.
  • Never paste production tokens into untrusted devices; decoding is local here, but the token itself is a credential.
  • Tokens with JWE (encrypted) structure have five segments and cannot be decoded as plain JWTs.

Technical reference

Related tools

Related guides