littlekit.
Free. No account.

JWT Decoder

Base64url-decodes the header and payload as UTF-8 JSON.

Your inputs stay in your browser. No account required.
Loading tool controls…

How JWT Decoder works

Base64url-decodes the header and payload as UTF-8 JSON. No key or signature verification is performed.

Try an example

Inspect the exp claim as a Unix timestamp using the related converter.

Good to know

Decoding does NOT verify authenticity, validity, security or authorization. Do not trust decoded claims. Input stays in this tab and is never sent to analytics. Limit 100,000 characters. No input is executed.

Your privacy

Processing happens on this device for this tool. We do not upload your input, put it in share links or save it to your favourites. Closing this tab discards the working input; downloaded results remain wherever you save them.

When this tool is useful

Decode a JWT locally when debugging its header and payload structure, without implying that the token is valid or trusted.

How to use it

  1. Paste the token into the local decoder.
  2. Inspect the header, claims and any readable timestamps.
  3. Verify the token with the issuing service and a trusted key separately before using it for access decisions.

Checks before you rely on the result

  • Decoding only reverses Base64URL encoding; it does not verify a signature, issuer, audience or expiry.
  • Treat the token as sensitive and do not paste it into screenshots, URLs or support messages.
  • Encrypted or non-JWT tokens will be rejected rather than guessed.

This page is maintained with the tool implementation and its deterministic tests. If the result looks wrong, report the issue with a non-sensitive example.

Read the JWT Decoder instructions

A useful next step

Unix Timestamp Converter
Base64 Decode
JSON Formatter
Made for clarity. Built to be useful.Report an issue