Decode tokens without pasting them into someone else’s server
Most online JWT tools run in the browser too, but few say so clearly or let you check. Json Works decodes and verifies with Web Crypto only; open your network tab and you will see no requests. Use it to inspect access tokens, debug expiry problems and confirm signatures while you work with Postman.
How to use JWT Decoder
- Paste a token (an
Authorization: Bearer …header works too). - Read the decoded header and payload, and check the expiry status.
- Optionally enter the secret or public key to verify the signature.
Private by design
JWT Decoder runs entirely in your browser. Your data is parsed and converted on your device with JavaScript — it is never sent to a server, logged or used for analytics. Recent inputs are kept in your browser’s own storage so you can come back to them, and they disappear when you clear cookies and site data (or press Clear history). You can verify this in your browser’s network tab.
Frequently asked questions
Is it safe to paste a real JWT here?
The token is decoded entirely in your browser; it is never sent to any server, and the page makes no requests with it. Still, treat production tokens carefully: anything you paste is also kept in this tool’s local history on your device until you clear it.
Can it verify signatures?
Yes. Enter the shared secret for HS256/384/512, or a PEM public key or JWK for RS256/384/512, PS256/384/512 and ES256/384/512. Verification uses your browser’s built-in Web Crypto and never leaves the tab. Your secret is never saved.
What do exp, iat and nbf mean?
They are time claims in seconds since 1970: exp is when the token expires, nbf is when it becomes valid and iat is when it was issued. The decoder shows them as readable dates with a live "expires in" or "expired" status.
Why does it say alg "none" is a problem?
A token with alg none is unsigned, so anyone can forge it. Servers must reject such tokens; the decoder flags them so you notice.