Home

JWT Decoder

Inspect JSON Web Tokens locally — header, payload, signature, algorithm, and expiration. Signatures are not verified here; use your API or auth library for that.

What you can do

  • Paste a compact JWT or Bearer <token>
  • View pretty-printed header and payload JSON
  • See alg and live exp countdown
  • Copy decoded JSON or the raw token

Decoding runs automatically as you type or paste.

Layout

Encoded token input at top, summary cards (algorithm, expiration), then Header, Payload, and Signature sections.

Expiration

If the payload includes exp, you get a live countdown (expires in / expired ago) plus local date/time. Without exp, the card shows No exp claim.

Sample

Sample loads a classic HS256 example token for trying the UI.

Tips

OAuth debugging: Paste an access token from the network tab locally instead of public JWT websites.

Quick alg check: Look for unexpected alg values in the header before trusting a token.

Privacy: Production tokens stay in your browser; nothing is uploaded.

Keep in mind

Supports standard three-part JWS tokens only (not encrypted JWE). Header and payload must be JSON objects.

App shortcuts

ActionShortcut
Search tools⌘ K
Close current tab⌘⌥E (Ctrl+Alt+E on Windows)

Note: ⌘W closes the browser tab. ⌘⇧E focuses the Explorer in Cursor/VS Code. Use ⌘⌥E (Ctrl+Alt+E) to close the current tool tab (click inside the app first so the IDE does not steal the shortcut).