JWT Decoder
Paste a JWT to instantly read its header and payload and see whether it has expired. Decoded locally — never uploaded.
Reviewed by the CalcCafe editorial team · Last updated 1 July 2026 · How we test our tools
Expires
Paste a full JWT (three dot-separated parts) to decode it.
How it works
The token's three parts are split on the dots; the header and payload are Base64URL-decoded and pretty-printed, and the exp claim is compared to the current time — locally in your browser.
100% client-side — nothing you paste is ever uploaded.
Frequently asked questions
Is my token uploaded?
No. The token is Base64URL-decoded entirely in your browser, so it's safe to inspect real tokens.
Does it verify the signature?
No — this decodes and displays the claims (header and payload) and checks the
exp claim. It does not verify the cryptographic signature, which needs the secret or public key.People also ask
What is a JWT decoder?
A JWT decoder splits a JSON Web Token into its three dot-separated parts, Base64URL-decodes the header and payload, and displays them as readable JSON so you can see the algorithm, claims, and expiry. It does not need the signing secret because those two parts are only encoded, not encrypted. This one runs entirely in your browser and also checks the exp claim against the current time.
Can I decode a JWT online?
Yes, paste the token above and the header and payload appear instantly along with whether it has expired. Because this decoder runs client-side, the token never leaves your browser, which matters since a live token can be replayed by anyone who sees it. Treat any tool that sends tokens to a server with more caution.
How to decode a JWT token?
Split the token on the dots, take the second part, replace - with + and _ with /, Base64-decode it, and parse the result as JSON. In JavaScript: JSON.parse(atob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))). The first part decodes the same way to reveal the header, and the third part is the signature, which is binary and not meant to be read.
Can you decode JWT without secret?
Yes, the header and payload are only Base64URL-encoded, so anyone holding the token can read them without a key. The secret or private key is needed only to verify the signature, which proves the token was issued by the expected party and has not been altered. That is why sensitive data should never be stored in a JWT payload.
Is JWT deprecated?
No, JWT is defined by RFC 7519 and remains the standard token format in OAuth 2.0 and OpenID Connect. What has changed is guidance on using it well: avoid the none algorithm, pin the expected algorithm on the server, keep tokens short-lived, and consider opaque session IDs for plain web sessions where you need instant revocation. The format itself is current.
What CLI tool can I use to decode JWTs?
A shell one-liner works with no install: echo "$TOKEN" | cut -d. -f2 | tr '_-' '/+' | base64 -d 2>/dev/null; echo, then pipe into jq . for formatting (add = padding if base64 complains about length). Dedicated CLIs include jwt-cli (the jwt command), and step crypto jwt inspect from the step CLI. All of these decode the same way this page does.
Related tools
Related calculators
- All Developer Tools
- UUID Generator
- URL Decode
- Regex Tester
- URL Encode
- Diff Checker
- Cron Expression Generator
- .gitignore Generator
- All developer tools →
Sources & references
These tools follow our methodology and provide educational estimates only — verify important figures with a qualified professional.