BracketJWT Decoder
Decode a JSON Web Token's header and payload instantly and inspect expiry. Your token is decoded locally in the browser and never leaves your machine.
🔒 Runs entirely in your browser — no data is ever sent anywhereWhen you need a JWT decoder
JWTs are the backbone of most modern session and API authentication, and when something goes wrong — a user gets logged out unexpectedly, an API call is rejected as unauthorized, an SSO integration returns claims that don't match what you expected — the fastest diagnostic step is almost always to look inside the token itself. Pasting it here shows exactly what claims the issuer put in, whether the token has already expired, and whether the payload matches what your backend or identity provider's documentation says it should contain, without writing a single line of debugging code.
What decoding a JWT actually shows you — and what it doesn't
A JWT is three Base64URL-encoded segments joined by dots: a header (describing the signing algorithm), a payload (the actual claims — things like sub, exp, iat, and any custom fields the issuer added), and a signature. Because the header and payload are just encoded JSON, not encrypted, anyone holding the token can read them — which is exactly what this tool does, entirely in your browser. What it deliberately does not do is verify the signature, since that requires the issuer's secret or public key, something this tool never asks for. A JWT that decodes cleanly here could still be a forged or expired token from a security standpoint — decoding tells you what the token claims, not whether a server should trust it.
Frequently asked questions
Is it safe to paste a real JWT into this tool?
Decoding happens entirely client-side — the token never touches a server. That said, JWTs often contain sensitive claims, so treat any tool (including this one) with the same care you'd use for other credential data.
Does this verify the token's signature?
No — this tool only decodes the header and payload, which are just Base64-encoded JSON and readable by anyone without a key. Verifying the signature requires the issuer's secret or public key, which this tool never asks for or has access to.
Why does it say my token is expired?
The payload's 'exp' claim is a Unix timestamp for when the token expires. This tool compares it against your current system clock — if your device's clock is wrong, expiry status may be misleading.
Related Security tools
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from text instantly.
x402 Payment Validator
Decode and validate an x402 protocol payment payload (the header AI agents and APIs exchange for HTTP 402 machine payments), including a real EIP-712/EIP-3009 ECDSA signature check against the declared sender.
Bracketly is free and open-source. If this tool saved you time, consider supporting it.
☕ Buy me a coffee