JWT, Base64 & URL Decoder
Decode JWT tokens to readable header, payload and expiry, and encode or decode Base64 and URL strings — all locally in your browser.
Data never leaves your browser.
100% client-side & private
Your tokens and text never leave the browser. Decoding and encoding happen locally; nothing is sent, logged or stored.
Related tools
- JSON Viewer & FormatterExplore, format, validate, and analyze JSON with an interactive tree, instant search, tables, and statistics.
- DeepSeek Peak Hours & PricingTrack DeepSeek API peak vs. off-peak hours in your local timezone with interactive timeline, live countdowns, and token pricing.
From the same maker: MarkdownMate - a fast Markdown notes app for Mac.
Frequently asked questions
- Is my JWT sent anywhere when I decode it?
- No. The token is split and Base64URL-decoded in your browser; it is not sent, logged or saved. A live token is still a credential, so avoid pasting it into tools you don't trust.
- Does the decoder verify the JWT signature?
- No. The signature is shown but not checked, because that needs the secret or public key and this tool never asks for one. A token that decodes cleanly is not proof that it is genuine. Tokens with alg "none" or an empty signature get a warning badge, since nothing protects them.
- How does it decide whether a token has expired?
- It compares the exp and nbf claims with your device's clock and also shows iat. A token without exp is shown as having no expiry.
- Can it read encrypted tokens (JWE)?
- No. An encrypted token has five parts and its payload can't be read without the key. The decoder reads signed three-part tokens (header.payload.signature).
- Can I paste the whole Authorization header?
- Yes. A leading "Bearer " is ignored, so you can paste the header value as it is.
- What do the Base64 and URL tabs do?
- The Base64 tab encodes text as UTF-8 and decodes standard or URL-safe Base64, with or without padding. The URL tab percent-encodes text and decodes it, reading + as a space.