JWT decoder (local)
Paste a JWT (or a whole Authorization: Bearer … line). The header and payload are base64url-decoded in this page and shown as JSON; iat, nbf and exp are converted to UTC dates and checked against your clock. Decoding is not verification: anyone can read a JWT, only the issuer's key proves it is genuine. Nothing is uploaded, so production tokens stay on your machine.
Frequently asked questions
Is it safe to paste a production token here?
The page decodes the token with JavaScript in your browser and makes no network requests with it, and the site has no analytics. You can check in DevTools → Network, or load the page and go offline before pasting.
Does this verify the signature?
No. Verifying needs the issuer's secret or public key; do it in your backend with a JWT library and an explicit list of allowed algorithms. Never trust a decoded payload without verification.
How do I decode a JWT on the command line?
Take the middle part: cut -d. -f2 <<< "$TOKEN" | tr '_-' '/+' | base64 -d. base64 may warn about missing = padding but still prints the JSON.
Why can't it read my token?
A token with 5 parts is an encrypted JWE: its payload can only be read with the key. Opaque access tokens (no dots) are not JWTs at all; ask the issuer's introspection endpoint instead.