JWT Decoder
Inspect JWT headers and payloads locally.
LocalYour data is processed locally in your browser and is not uploaded to Alphzen.
Decoding is not verification. A valid-looking payload can be forged. The token is processed locally and is not uploaded.
Paste a token and decode it to inspect claims.
How to use
- Paste a JWT (three base64url parts separated by dots).
- Select Decode.
- Read the header, payload, and time claims. Check the warnings.
- Copy JSON if you need it in another tool.
Features
- Decodes header and payload as JSON.
- Shows exp, nbf, and iat as ISO timestamps.
- Warns on expired tokens and alg: none.
- Does not verify signatures — a decoded payload is not a trusted identity.
- The token never leaves your browser.
Examples
header.payload.signature
Each part is base64url. Only the first two parts are JSON.
FAQ
Does this verify the token?
No. Verification needs the issuer’s key and a signature check. This page only reads the bytes that were encoded. Anyone can mint a JWT-shaped string with a plausible payload.
Is it safe to paste a production token?
The token is not sent to Alphzen. It is still visible to your browser, extensions, and anyone who can see your screen. Prefer a non-production token when you can.
What about encrypted JWTs (JWE)?
This tool expects a JWS compact serialization with three segments. Encrypted tokens are a different format and cannot be read without the key.
Related guides
Related tools
About this tool
A JSON Web Token is three encoded segments: a header, a payload, and a signature. Decoding the first two is a convenience for debugging. It is not authentication.
Alphzen pretty-prints the JSON and interprets numeric time claims. The signature is displayed as it arrived; it is not checked.
Related tools: Base64 Encoder for the alphabet JWTs use, and JSON Formatter if you want to edit a payload as JSON.