JWT Decoder
Paste a token.
See what's inside.
Encoded token
HS256
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Orrgo User",
"role": "admin",
"iat": 1760944000,
"exp": 1999999999
}To decode a JWT, paste the token (with or without "Bearer "). The header and payload are shown as formatted JSON, and standard claims like exp, iat and nbf are converted to readable dates with an expired / not-expired badge.
Standard JWT claims
| Claim | Meaning |
|---|---|
| iss | Issuer — who created the token |
| sub | Subject — usually the user ID |
| aud | Audience — who the token is for |
| exp | Expiry time (Unix seconds) |
| nbf | Not valid before (Unix seconds) |
| iat | Issued at (Unix seconds) |
| jti | Unique token ID |
Why it matters that this runs locally
Many online developer tools send what you paste to a server — risky when it contains API keys, session tokens, customer data or proprietary code. This tool runs entirely in your browser: open your browser's Network tab and you will see that nothing you type is sent anywhere.
Related tools
Frequently asked questions
- Is it safe to paste a production token here?
- Yes. Decoding happens entirely in your browser and nothing is sent or logged. Still, treat tokens like passwords and revoke any that may have leaked.
- Does this verify the signature?
- No — it decodes only. Verifying a signature requires the secret or public key, which should stay on your server.
- Is my data sent to a server?
- No. Everything runs in your browser, so tokens, keys, passwords and other sensitive data you paste never leave your device.