# JWT Decoder

> Decode a JSON Web Token to inspect its header, payload and expiry — locally, never sent anywhere.

To decode a JWT, paste the token above and its header and payload are Base64-decoded and shown as formatted JSON, along with issued-at and expiry timestamps in readable form. Decoding happens entirely in your browser, so the token is never transmitted or logged.

**URL:** https://convertto.tech/t/jwt-decoder
**Category:** Encoders & Decoders (https://convertto.tech/c/encoding-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Privacy:** Runs entirely in your browser — nothing is uploaded
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter or paste your jwt.
2. The result appears immediately — copy or download it.

## FAQ

### Does this verify the JWT signature?

No. Verification requires the signing secret or public key. This tool deliberately never asks for a secret — pasting one into a website would compromise it.

### Is it safe to paste a real token here?

The decoding runs entirely in your browser with no network request. That said, treat any token you paste anywhere as potentially exposed, and rotate production credentials rather than reusing them.

## Sources

- [RFC 7519 - JSON Web Token (JWT)](https://www.rfc-editor.org/rfc/rfc7519) — IETF
- [RFC 7515 - JSON Web Signature (JWS)](https://www.rfc-editor.org/rfc/rfc7515) — IETF

## Related tools

- [JWT Verifier](https://convertto.tech/t/jwt-verifier): Verify a JWT's HS256 signature and its expiry, issuer and audience claims, entirely in your browser.
- [JWT Signer](https://convertto.tech/t/jwt-signer): Create a signed HS256, HS384 or HS512 JSON Web Token for testing, entirely in your browser.
- [Base32 Encoder & Decoder](https://convertto.tech/t/base32-encode-decode): Encode and decode Base32 (RFC 4648) — used by TOTP secrets and case-insensitive identifiers.
- [Base58 Encoder & Decoder](https://convertto.tech/t/base58-encode-decode): Encode and decode Base58 — the Bitcoin alphabet that omits look-alike characters.
- [Base64 Encoder & Decoder](https://convertto.tech/t/base64-encode-decode): Encode and decode Base64 with automatic direction detection, plus file and data-URI support.
- [Binary to Text Converter](https://convertto.tech/t/binary-to-text): Translate text into binary ones and zeros, and decode binary back into readable text.
- [Hex to Text Converter](https://convertto.tech/t/hex-to-text): Convert text to hexadecimal bytes and decode hex strings back into readable text.
- [HTML Entity Encoder & Decoder](https://convertto.tech/t/html-entity-encode-decode): Convert characters to HTML entities and back — escape markup safely for display.