JWT Decoder
Free JWT decoder. Paste a JSON Web Token to decode and inspect its header and payload, view standard claims and check expiry — all in your browser, nothing uploaded.
Decoded header JSON appears here.
Decoded payload JSON appears here.
The raw signature segment appears here.
🔒 Decoding happens entirely in your browser — your token is never uploaded, logged or sent anywhere. This tool only decodes a JWT so you can read it; it does not verify the signature, and it never asks for your secret or key.
Free JWT Decoder
This free online JWT decoder lets you paste a JSON Web Token and instantly read what is inside it.
It pretty-prints the header and payload in separate panels, shows the raw signature,
and translates the standard time claims (exp, iat, nbf) into readable dates so
you can see at a glance whether a token has expired. Everything is decoded right here in your browser — your token
is never uploaded, and the tool never asks for your secret key.
How to use the JWT decoder
- Copy your token from your app, API response, browser storage or an
Authorization: Bearerheader. - Paste it into the box above (or click Load sample to try one).
- Click Decode token. The header and payload appear as formatted JSON in their own panels.
- Check the standard claims table for human-readable issued, not-before and expiry dates.
- Use the Copy button on any panel to grab the decoded JSON.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to carry claims between two parties — most
commonly used for login sessions and API authentication. A JWT is a single string made of three parts separated by dots:
header.payload.signature. The header describes the token type and the signing algorithm
(for example {"alg":"HS256","typ":"JWT"}). The payload holds the claims — the actual
data — and the signature is a cryptographic stamp that proves the token has not been tampered with.
The header and payload are JSON objects that are Base64URL-encoded (a URL-safe variant of Base64 that
uses - and _ and often drops padding). That encoding is not encryption, so anyone can
decode and read a JWT — which is exactly what this tool does. Common registered claims include
iss (issuer), sub (subject, often the user ID), aud (audience), exp
(expiry time), iat (issued-at time) and nbf (not-before time). Time claims are stored as Unix
timestamps, which this decoder converts to readable dates.
Importantly, decoding is not the same as verifying. Verifying a token means checking its signature against the secret or public key to confirm it is authentic and untampered. This tool deliberately stays on the safe side: it only decodes and inspects what is in the token, so you never have to paste a secret into a web page.