Decode a JWT's header and payload — locally, nothing sent.
A JSON Web Token (JWT) has three Base64URL parts: header, payload and signature. This decoder shows the header and payload as readable JSON and converts the exp claim into a human date so you can see if the token is expired. Decoding happens entirely in your browser — your token is never transmitted.
No. Decoding is done locally in your browser with JavaScript. Your JWT never leaves your device — safe for sensitive tokens.
No. It decodes the readable header and payload. Verifying the signature requires the secret or public key and should be done server-side.
JWT payloads are only Base64-encoded, not encrypted. Anyone can read them — never put secrets in a JWT payload.