JWT decoder
Inspect token claims without submitting the token.
Decode the JSON header and payload of a compact JWT and turn numeric date claims into readable UTC timestamps. Processing stays inside the tab.
Paste a token to inspect it.
Why can a JWT be decoded without a key?
The compact header and payload use Base64URL encoding, which is reversible and provides no secrecy. Authenticity normally comes from validating the signature with an explicitly trusted key and enforcing the application’s claim rules.
Should a production token be pasted anywhere?
A bearer token can grant access to whoever possesses it. Prefer a development token with no useful privileges. This page processes input locally, but a compromised browser, extension, or device can still observe sensitive values.