quietkit

Search tools

Security tools

JWT Decoder

Read a JWT header, payload and time claims locally. No signature verification.

Runs locally
Signature not verified

Drop a JWT file here, or choose Open file. Up to 1 MB. Files stay in your browser.

Preview limit: 1 MB (1,000,000 UTF-8 bytes). Output is limited to 2 MB. Large text scrolls horizontally.

Guide

Inspect a JSON Web Token (JWT) to see its header, payload and time claims. Decoding helps you read what the token says. Its signature is not verified here, so the result cannot establish who issued it.

  1. Add a token

    Paste the token without a Bearer prefix. You can also try Example token, Example dates or Open file.

  2. Read the contents

    Output shows the header and payload as JSON. timeClaims shows recognised dates in UTC.

  3. Check what the result means

    Signature not verified means the claims are untrusted. Decoding does not prove validity or grant access.

  4. Keep the result

    Copy output or Download exports the displayed document, including signatureVerified: false. Token sharing is unavailable.

On mobile, choose Output to read the result. Clear removes both fields.

Reading the result

  • Header: describes the token's declared type and algorithm.
  • Payload: contains the claims supplied by the token's creator.
  • Time claims: show recognised timestamps as dates.
  • Signature not verified: decoding does not prove that any claim is true or grant access.
Shortcuts
  • Ctrl / Cmd + Enter — Run selected action
  • Ctrl / Cmd + Shift + C — Copy output
  • Ctrl / Cmd + S — Download output
  • ? — Show shortcuts outside text fields

Shortcuts work while focus is in the workspace. Copy and download need valid output.

Common questions
Does a readable result mean the token is valid?
No. The signature and claims are not verified. The output is only a readable representation of untrusted data.
Why are dates shown in UTC?
JWT time claims use NumericDate seconds. UTC gives a consistent date independent of your computer's timezone. A displayed date does not establish validity.
Is my token stored or sent anywhere?
No. The tool processes it locally and keeps it only in the open page. Copy and download happen only when you request them.
Can I decrypt a token or enter a key?
No. This preview only decodes a three-part token. It has no decryption or signature-verification feature.
Which token formats are supported?
Compact three-part JWTs with Base64url-encoded JSON objects. Encrypted five-part tokens, nested tokens and unencoded payloads are unsupported.
What happens to unusual time claims or numbers?
Unusable time claims receive a neutral note. Very large integers can lose precision; non-finite numbers are rejected.

Was this tool helpful?

Only your rating and optional feedback are sent. Your tool input and output are never included.