JWT Decoder

Decode a JWT to inspect its header and payload, check expiry, and optionally verify the HMAC signature with a secret. Runs entirely in your browser — tokens are never sent anywhere.

How to use JWT Decoder: Open JWT Decoder — it runs entirely in your browser with no setup. Paste or type your input into the text area, or upload a file where supported. Set any options you need. The result appears in the output panel — there is no upload step and no waiting on a server. Everything runs inside your browser, so your data never leaves your device.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "iat": 1516239022
}

Verify signature (HMAC)

Decode a JWT to inspect its header and payload, check expiry, and optionally verify the HMAC signature with a secret. Runs entirely in your browser — tokens are never sent anywhere. JWT Decoder is a free, browser-based tool in the Filevane developer tools collection — there is nothing to install, no account to create and no watermark on your results. It works on desktop, tablet and mobile, and because the work happens on your own device it stays fast even with large inputs.

How to use JWT Decoder

Open JWT Decoder — it runs entirely in your browser with no setup.
Paste or type your input into the text area, or upload a file where supported.
Set any options you need. The result appears in the output panel — there is no upload step and no waiting on a server.
Review the output instantly; large inputs are handled locally without lag.
Copy the result to your clipboard or download it. Your data never leaves the page.

Why use JWT Decoder?

100% free with no limits, no sign-up and no watermarks.
Private by design — your data are processed in your browser and never uploaded to a server.
Fast and lightweight, with instant results even on a phone or a slow connection.
Works everywhere — any modern browser on Windows, macOS, Linux, Android or iOS.
Part of a full developer tools suite, so related jwt decoder tasks are one click away.

What people use JWT Decoder for

Inspecting the claims inside a token when debugging an authorisation failure.
Checking a token's expiry to confirm whether it has lapsed.
Seeing which algorithm and key ID a token declares.

JWT Decoder: limits and things worth knowing

A JWT is encoded, not encrypted. The header and payload are base64url text that anyone holding the token can read, so a JWT must never carry a secret.
Decoding is not verifying. A decoded token proves nothing about authenticity — only checking the signature against the correct key does that, and it must happen server-side.
The exp and iat claims are Unix timestamps in seconds, not milliseconds. Multiplying by the wrong factor is a routine cause of tokens that appear to expire in 1970 or in the year 56000.
Never paste a live production token into a server-side decoder: doing so hands a working credential to a third party. This one runs entirely in your browser, which is the whole reason it exists.
An alg of "none" in a token is a red flag — historically a real authentication bypass in libraries that honoured it.

Sources

RFC 7519 — JSON Web Token (JWT)

Is it private and secure?

Your privacy is built in. JWT Decoder runs completely on your device, so whatever you enter stays in your browser and is never transmitted, logged or stored on any server.

Network activity: none. Nothing is sent and nothing is fetched. This tool makes no network request at all once the page has loaded — which is why it keeps working if your connection drops.

You do not have to take that on trust — our privacy proof page publishes the Content-Security-Policy that enforces it, lists every third party it permits, and shows how to verify the whole claim yourself.

Learn more

Is It Safe to Paste Production Data Into Online Tools? — JWTs, API responses and env files get pasted into online formatters every day. Here's what actually happens to that data and how to check before you paste.

See all free developer tools or browse the full tool catalogue.