Decode a JWT safely — without sending it anywhere
Tokens carry session data, emails, and roles. Inspect them locally in your browser, where no server ever sees the contents.
Why “safely” matters
A JWT is not encrypted — its payload is just Base64URL-encoded JSON. That is exactly why decoding it is easy, but also why pasting a token into a random website is risky: many online decoders ship the token straight to their backend, where it can sit in logs and analytics. A live session token in the wrong log is a real security problem.
The safe workflow is local-first: the decoding happens in your browser with JavaScript, the token never leaves your device, and you still get the full header and payload breakdown — algorithm, claims, and human-readable timestamps.
The workflow, step by step
- 1
Copy the JWT you need to inspect — from browser storage, a response body, or the Authorization header.
- 2
Paste it into the JWT Decoder. The header and payload decode instantly as you type.
- 3
Check the alg, sub, and role claims, then read exp and iat as human-readable dates.
- 4
Copy only the parts you need for your debugging notes — not the whole token.
Inspect your token now
Open the decoder, paste your JWT, and read every claim in seconds. Local-only, free, and no signup.
Open JWT DecoderFrequently asked questions
Is it safe to paste a JWT into an online decoder?
It depends on the decoder. Most online tools send your token to their server, where it can be logged. The Simply Tools JWT Decoder works the opposite way: decoding happens entirely in your browser with JavaScript, so the token never leaves your device. Even so, avoid decoding live production tokens on shared machines.
What is the difference between decoding and verifying a JWT?
Decoding just reads the token — the header and payload are plain Base64URL, so anyone can read them without a key. Verifying proves the token was actually issued by your server and was not modified; that requires the secret or public key and a signature check. Use a decoder to inspect, your backend to verify.
How do I check when a JWT expires?
Look at the exp claim in the payload. It is a Unix timestamp in seconds. If it is in the past, the token has expired. The decoder highlights exp and iat claims so you can spot session problems quickly.
Can anyone read the payload of a JWT?
Yes. A JWT is signed, not encrypted — Base64URL is an encoding, not protection. Never put secrets like passwords or card numbers in a payload. If you need confidentiality, use encrypted tokens (JWE) or keep sensitive data on the server.