This only decodes the token — it does not verify the signature. Never paste a token you don't trust into an untrusted site.
Keep going with what you just made.
eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRhIiwicm9sZSI6ImFkbWluIn0.abc{
"user": "ada",
"role": "admin"
}Decode header + payload, no verification
Sample output — your files never leave your device.
Here, yes — decoding is pure local base64url + JSON parsing; the token is never transmitted. As a habit though, treat JWTs as credentials: prefer offline tools and never paste production tokens into sites you don't control.
No — and that's important to understand. Decoding reads the payload; it doesn't prove the token is authentic. Verification needs the signing key or public key, which happens server-side in a real system.
exp is the expiry timestamp — the decoder shows live whether the token is expired. iat is the issued-at time. Both are Unix timestamps in the payload.
A JWT has three base64url segments separated by dots — header.payload.signature. If decoding fails, the string is truncated, has whitespace inside it, or isn't actually a JWT (e.g. an opaque token, which can't be decoded by design).
No — this decodes signed (JWS) tokens whose payload is base64url JSON. JWE tokens are encrypted and require the decryption key.
Yes. JWT Decoder is completely free on GenRise, with no limits, watermarks, or hidden paywalls.
No. Every GenRise tool works instantly in your browser — no account, email, or sign-up required.
No. JWT Decoder runs entirely on-device using your browser, so your files are never uploaded or stored anywhere. All processing happens locally.
JWT Decoder uses your browser's built-in capabilities — Canvas, WebAssembly, and File APIs — to process files locally. Decode a JSON Web Token's header and payload instantly. Simply open the tool, select your file, and the result is generated instantly on your device.
Yes. Since JWT Decoder processes everything in your browser, your files never leave your device. There is no server-side storage, no tracking of file contents, and no data collection.
Yes. JWT Decoder works on any modern browser, including mobile devices. It is fully responsive and optimized for both desktop and mobile use.
GenRise JWT Decoder splits a JSON Web Token into its header and payload and presents the claims readably — with live status for exp and iat so you can see at a glance whether the token is expired and when it was issued. The important difference from pasting tokens into hosted debuggers: decoding happens entirely in your browser, so the credential never transits a third party. It deliberately decodes only — signature verification isn't attempted, since that requires the signing key.
JWT Decoder runs entirely in your browser. Anything you enter or upload is processed locally and never sent to a server. There is no account required, no tracking of your content, and no data collection.