JWT Decoder
Decode a JWT's header and payload and see whether it has expired. The token never leaves your browser.
- No uploads
- No limits
- No signup
The signature is NOT verified. Decoding only reads the token; it does not prove who issued it or that it is untampered. Never trust a token based on this page alone.
Decoded in your browser. The token is never sent anywhere.
- Input:
- JWT
- Output:
- Claims
- Runs on:
- Your device
- Size limit:
- None
- Account:
- Not needed
How to use JWT Decoder
Paste your token
Paste the JWT into the box. A leading "Bearer " prefix is fine.
Read the claims
The header and payload are decoded instantly, with exp, iat and nbf shown in your local time and UTC, plus an Expired, Not yet valid or Valid badge.
Copy the payload
Copy the pretty-printed payload JSON. Remember that the signature is not verified here.
Why JWT Decoder on Toolshed
No uploads
Everything runs in this browser tab. Your files never leave your device.
No limits
No file-size caps, no daily quotas. Process as much as your device can handle.
No signup
No account, no email, no watermark.
Frequently asked questions
Does this verify the signature?
No. It only decodes the header and payload, which are plain base64url JSON. Verifying a signature needs the secret or public key and should happen on your server.
Is my token sent to a server?
No. Decoding happens entirely in your browser, so tokens containing real user data never leave your device.
Are my files uploaded anywhere?
No. JWT Decoder runs entirely in your browser. Your files are processed on your device and are never sent to a server.
Is there a file size limit?
No fixed limit. The only limit is your device's memory. Very large files work best in a desktop browser.
Is JWT Decoder really free?
Yes. There's no account and no watermark. A short optional ad, or a 20-second wait, unlocks each download. That's how we keep it free.
Does it work offline?
Once the page has loaded, processing happens locally, so it keeps working even if your connection drops.