French Baguette Tools
JWT Token Decoder
Paste a token to read its header and payload. Nothing is sent anywhere.
The JWT token decoder is a free tool that runs entirely in your browser, with no data ever sent to a server. Read a token’s header and payload, with its expiry date.
What a JWT is
A JWT has three parts separated by dots: the header, naming the signing algorithm, the payload, carrying the claims, and the signature, proving the token was not altered. The first two are merely Base64-encoded, so anyone can read them.
Why the signature is not verified here
Verifying a signature requires the secret key of the server that issued the token. Pasting it into a web page would mean disclosing it. This tool deliberately stops at reading, which covers the vast majority of debugging needs.
What this tool does not do
This tool decodes, it does not authenticate: it checks neither the signature nor the token’s real validity with its issuer. An expired or forged token will still be displayed, with its expiry date in plain sight.
Frequently asked questions
Is my token sent anywhere?
No. Decoding happens in your browser, in JavaScript. The token never leaves your device, which matters all the more since a live token grants access to an account.
Why is the expiry date a large number?
The exp claim is a Unix timestamp, in seconds since 1970. The tool also shows it as a readable date, just below the decoded payload.
Is my data sent to a server?
No: the text you type or paste is processed entirely in your browser, on your device. It is never transmitted to a server.
Do I need an account or an install?
No: the tool works directly on this page, with no sign-up and no installation.