OpenGPT.in

JWT Decoder

Read what a JSON Web Token says — without verifying it.

Runs in your browser Runs entirely in your browser. Nothing you put in it ever leaves your device.

This decodes the token. It does not verify it.

Anyone can read a JWT — that is what Base64 is. Nothing on this page checks the signature, because checking it needs the issuer’s secret or public key, which should never be pasted into a website. Treat everything below as what the token claims about itself, not as proof that any of it is true.

Decodes as you type. A leading Bearer is ignored, so you can paste an Authorization header straight in.

Ready. The token stays in this page.

Was this useful?

About this tool

A JSON Web Token is three Base64 segments: a header, a set of claims, and a signature. This page decodes the first two and explains the standard claims, showing expiry and issued-at as dates you can actually read. It does not check the signature, and is explicit about that everywhere — decoding tells you what a token says, never whether it is genuine.

How to use it

  1. Paste the token — a leading “Bearer” is ignored, so an Authorization header works too.
  2. Read the claims. Standard ones are named and explained; your own appear underneath.
  3. Check the expiry banner, which says whether the token claims to still be valid.
  4. Copy the payload or header as JSON if you need it elsewhere.

Supported input

  • A signed JWT (JWS) in the usual three-part form
  • A token with “alg”: “none”, which is flagged as unsigned
  • An Authorization header value, with or without the Bearer prefix

Privacy

Runs entirely in your browser. Nothing you put in it ever leaves your device. Everything happens in JavaScript on this page, so the tool keeps working even if you go offline after it has loaded — which is the simplest way to see for yourself that nothing is being sent. Read the full privacy information.

Questions

Does this verify the token?

No, and that is deliberate. Verifying a signature requires the issuer’s secret or public key. Pasting a signing secret into any website — including this one — would be handing over the ability to mint tokens, so this tool does not ask for one and cannot check anything.

So a token that decodes cleanly might still be fake?

Yes. Anyone can write a JSON object, Base64 it and attach a made-up signature. It will decode perfectly here and be rejected instantly by any server that checks it. Treat what you see as a claim, not as a fact.

Is my token sent anywhere?

No. It is decoded by JavaScript on this page. It is never put in the URL, never stored in your browser, and never included in any usage statistic — the only thing recorded is that the decoder was used, never what it was given.

Why is the expiry a huge number in the raw claim?

Because JWT timestamps are seconds since 1 January 1970, not milliseconds. This page shows both: the readable date and the number that is actually in the token, so you can compare it against your own logs.

My token has five parts and will not decode.

That is a JWE — an encrypted token rather than a signed one. Its payload is genuinely unreadable without the decryption key, so there is nothing any decoder can show you.

Should I paste a production token in here at all?

A live token is a credential, so treat it like a password: prefer a test one. That said, nothing on this page transmits or stores it, and closing the tab is enough to be rid of it.

Related tools