JWT Decoder Online — No Upload, Stays Local

🔒 Runs entirely in your browser · Nothing uploaded or saved · Tokens never written to the URL · Free, no sign-up

How to decode a JWT

Paste a JWT

Drop in a three-part token. Nothing is uploaded — decode happens on your device.

Inspect header & payload

Live pretty JSON for both parts, plus copy buttons for JSON and individual claims.

Check claim times

exp / iat / nbf show as local times with expired or not-yet-valid badges.

Optional verify

Enter an HS* secret or RS*/ES* PEM public key. Unsupported algs say so clearly.

A JWT tool that keeps tokens on your device

Jwtly base64url-decodes the header and payload in your browser and pretty-prints them as JSON. Time claims (exp, iat, nbf) are shown as local times with expired / not-yet-valid badges. Optional signature verify uses the Web Crypto API only — HS* with a shared secret, RS* / ES* with a PEM public key. Tokens and secrets are never uploaded and never written to the URL hash or query.

Features

Live decode of header and payload as pretty JSON
exp / iat / nbf as human-readable local times with badges
Optional Web Crypto verify for HS256–512, RS256–512, ES256–512
Copy header JSON, payload JSON, and individual claims

Why Jwtly?

🚫 No upload: JWT and keys never leave your browser
🛡️ Tokens are never put into the URL (no careless share-link leak)
✅ Clear “unsupported” for algs we cannot verify — never a fake pass
🆓 Free, no sign-up, no limits

All ToolBookly tools · BaselY · Hashly · JSONly · Regexly

Frequently Asked Questions

Is my JWT uploaded anywhere?

No. Jwtly decodes and inspects JWTs entirely in your browser. The token and any secret or public key you enter never leave your device. Nothing is sent to ToolBookly or saved on a server.

How do I decode a Bearer token?

A Bearer token in an Authorization header is usually a JWT. Paste the whole value — including “Bearer ” or even “Authorization: Bearer …” — and Jwtly strips the prefix and decodes the header and payload locally, so you can read claims like sub, aud, iss and exp without sending the token anywhere.

Why is there no share link for my token?

Auth tokens are sensitive. Jwtly deliberately never puts the raw JWT or secrets into the URL hash or query string, so a copied page link cannot leak your token the way careless tools sometimes do.

Is decoding the same as verifying?

No. Decoding only base64url-decodes the header and payload so you can read claims. Verification checks the signature with your secret (HS*) or PEM public key (RS*/ES*). Without the right key, anyone can still read a JWT — that is by design.

Which algorithms can Jwtly verify?

MVP verify uses Web Crypto only: HS256/HS384/HS512 with a shared secret, and RS256/RS384/RS512 plus ES256/ES384/ES512 with a PEM public key. Other algs still decode; verify shows “unsupported in MVP” instead of faking a result.

What do the exp / iat / nbf badges mean?

exp (expiry), iat (issued-at) and nbf (not-before) are Unix timestamps. Jwtly shows them as local times and flags expired or not-yet-valid tokens against your device clock.

How do I pretty-print the payload JSON?

Jwtly already shows header and payload as live pretty JSON. For a full formatter with minify, sort keys, tree view and exact error line/column on larger documents, open JSONly — the same no-upload ToolBookly tool for JSON only. Open JSONly — JSON formatter & validator ↗

Is Jwtly free?

Yes. Free, no sign-up, no usage limits. It is part of the ToolBookly suite of browser tools.