Free JWT Decoder Online
Decode and inspect JSON Web Tokens. View header, payload, claims and expiry status instantly in your browser.
Key Features
Everything you need to inspect JWT tokens
Paste any JWT token and see the decoded header and payload immediately with no button press needed.
Automatically checks the exp claim and shows a clear valid or expired badge so you know token status at a glance.
Browser-side decoding runs locally in your browser. Avoid entering sensitive tokens unless local processing is clearly shown.
Key Takeaways
- Decoding runs entirely in your browser, so the token stays on your device and processing starts automatically as you type or paste.
- The tool decodes the header and payload into formatted JSON and shows a claims table with exp, iat, and nbf timestamps converted to readable UTC dates.
- It does not verify the signature, so a decoded token is not proof of authenticity - use a server-side library with the matching secret or public key for that.
- Paste only the raw three-part token without the Bearer prefix, surrounding quotes, or whitespace, since a JWT must have exactly three dot-separated segments to decode.
How to Decode a JWT Token Online
Paste the token
Copy the full JWT (the three dot-separated parts: header, payload, and signature) and paste it into the input box. Decoding runs automatically in your browser as you type or paste, so you do not have to click Decode first.
Read the header and payload
The base64url header and payload are decoded into pretty-printed JSON. The header shows the signing algorithm (alg) and token type (typ), while the payload lists every claim the issuer placed in the token.
Inspect claims and expiry
Review the claims table for a row-by-row view, where exp, iat, and nbf timestamps are converted to human-readable UTC dates. The expiry badge reads the exp claim and shows Valid, Expired, or No expiry claim at a glance.
What This Decoder Shows You
A JWT has three base64url-encoded segments joined by dots. This tool reads all three and presents each part differently. It decodes and displays the contents but does not verify the signature, which would require the secret or public key.
| JWT Part | What It Holds | How This Tool Handles It |
|---|---|---|
| Header | Signing algorithm (alg) and token type (typ) | Decoded to formatted JSON |
| Payload | Claims such as sub, iss, aud, exp, iat, nbf | Decoded to JSON and to a claims table |
| Signature | Cryptographic signature over header and payload | Displayed as raw text, not verified |
| exp / iat / nbf | Unix timestamps in seconds | Converted to readable UTC dates |
| Expiry status | Whether exp is in the past | Shown as a Valid, Expired, or No expiry badge |
| Processing | Where decoding happens | Runs locally in your browser, no upload |
When to Use a JWT Decoder
Debugging auth flows
Quickly see which claims an identity provider or API gateway issued, confirm the subject and audience, and spot a wrong issuer or missing scope without writing any code.
Checking expiry
When a request returns 401 or a session drops, paste the token to read the exp date in UTC and confirm whether the token has already expired or is not yet valid because of nbf.
Inspecting custom claims
The claims table lists every payload field, so you can verify custom roles, tenant IDs, or feature flags an application embedded in the token.
When NOT to rely on it
This tool decodes only. It does not verify the signature, so it cannot tell you whether a token is authentic or tampered with. Use a server-side library with the key for that.
Common Problems and Fixes
Invalid JWT: expected 3 parts
A JWT must have exactly three segments separated by dots. This error means a segment is missing or you pasted extra text. Remove any surrounding quotes, the Bearer prefix, or trailing whitespace and paste only the raw token.
Failed to decode header or payload
This appears when a segment is not valid base64url JSON, often from a copy that was truncated or line-wrapped. Re-copy the complete token in one piece and make sure no characters were dropped at the edges.
Badge says Expired but the token works elsewhere
The badge compares the exp claim to your device clock in UTC. If your system time is wrong, the status can be misleading. Check your clock, and remember exp and iat are shown in UTC, not local time.
Signature shows but is not checked
The signature segment is displayed as text only. This tool never validates it, so a decoded token is not proof of authenticity. Verify the signature in your backend using the matching secret or public key.
About This Tool
This free JWT decoder lets you paste any JSON Web Token and instantly see the decoded header, payload and signature. All claims are displayed in a formatted table including timestamps converted to human-readable dates.
Frequently Asked Questions
Is this tool completely free?
Yes. The tool is 100% free to use with no registration, no subscription and no usage limits.
You can use it as many times as you need for personal or commercial projects without any cost.
We believe developer tools should be accessible to everyone without paywalls.
Is my JWT token safe to paste here?
Yes. Everything runs locally in your browser using JavaScript. No data is transmitted to our servers — your files never leave your device.
Your tokens stay on your device and are not logged or sent elsewhere. The decoding happens entirely in your browser.
You should still avoid pasting production tokens containing sensitive information into any online tool out of good security practice.
Does this tool verify the JWT signature?
No. This tool only decodes the base64url-encoded parts of the JWT. It does not verify the HMAC or RSA signature.
Signature verification requires knowledge of the secret key or public key which should never be shared with a browser tool.
If you need to verify a signature, use a server-side library in your backend code.
What is a JWT token?
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. It consists of three base64url-encoded parts separated by dots: header, payload and signature.
The header specifies the algorithm used. The payload contains claims such as the subject, issued-at time and expiry. The signature ensures the token has not been tampered with.
JWTs are widely used in authentication and authorization flows in modern web applications and APIs.
Sources and References
Format and tool details on this page are based on the official specifications and documentation below.
- RFC 7519: JSON Web Token (JWT)- IETF
- Introduction to JSON Web Tokens- jwt.io
- RFC 8259: The JSON Data Interchange Format- IETF
- JSON- MDN Web Docs