Decode JSON Web Tokens instantly — inspect header, claims and expiry. 100% local: your token never leaves this page.
Debugging auth failures means inspecting JWTs — but pasting tokens from production into an online decoder leaks real credentials to a third-party server.
CapabilityBase decodes in your browser, with zero network calls: check exp, iat, iss and claims without ever uploading the token.
| ID | jwt.decode |
| Version | 1.0.0 |
| Status | stable |
| Category | Security / Auth |
| Contract | deterministic, no side effects, local, no AI |
| Runtime | Browser, Node, Edge, Worker |
| Consumes | jwt |
| Produces | json |
alg (HS256 / RS256), typ, kid — identifies signing algorithmexp, iat, nbf, iss, sub, aud, jti extracted and explained⚠️ Signature verification needs the secret/public key and is intentionally not performed — decoding alone never validates authenticity.
AI is probabilistic. Your tools shouldn't be.
No. Decoding happens 100% in your browser with zero network calls — safe to inspect production tokens that must never be uploaded.
No — signature verification requires the secret or public key, which the tool intentionally never asks for. It decodes header/payload and computes expiry, but cannot confirm authenticity.
exp (expiry with live remaining time), iat, nbf, iss, sub, aud and jti are parsed and displayed alongside the full header and payload JSON.
Yes — pass ?input=<token> or ?jwt=<token> and the page decodes automatically, making it usable as a deterministic tool by scripts and agents.
Deploy this tool on Vercel · Ship faster with Cursor · Your static site on Cloudflare