glyphcount

JWT Decoder

Paste a JSON Web Token to read its header and payload instantly — claim by claim, decoded locally, never validated or uploaded.

Paste any JWT and its header and payload decode instantly and format as readable JSON, with the expiration timestamp translated to a human-readable date. The signature is displayed but not verified.A JWT is three Base64URL segments joined by dots: header, payload, signature. This tool decodes the first two locally — decoding is not validation, and a forged token decodes just as cleanly as a real one.
Decodes locally — the token never leaves your browser.

Written by Nan Liang · Updated November 2026

Frequently asked questions

Does this validate the token signature?

No, and that matters: decoding a JWT proves nothing about who issued it. Only the receiving server, which holds the signing key, can verify the signature. Treat decoded claims as untrusted input.

Is it safe to paste a live token here?

The decoding happens locally in your browser — the token never leaves your machine. Still, treat production tokens as sensitive: anyone holding one can present it to the API until it expires.

What do the standard claims mean?

exp is the expiration time, iat the issued-at time, nbf "not before" (earliest valid time), sub the subject (usually a user ID), iss the issuer, aud the audience. All are optional except what your API requires.

Why does decoding fail with "not valid Base64URL"?

The token may be corrupted, or you pasted only part of it — a JWT always has exactly three dot-separated segments. Check for line breaks or a missing final segment.

Next steps

JWTs are Base64URL under the hood — the Base64 Converter handles the same encoding for any text.

Open the Base64 Converter →