JWT Decoder
A free online JWT decoder for reading any JSON Web Token. Paste a token to see its header, payload and signature, every standard claim explained, and whether it has expired. Decoding happens entirely in your browser — the token is never sent anywhere.
JWT Decoder
Paste a JSON Web Token below. It is decoded in your browser as you type, and nothing is uploaded or stored.
Paste a token above to decode it.
Nothing decoded yet.
The token is decoded locally with JavaScript. It is never sent to a server, never logged and never saved — not even in your browser storage.
The standard claims, explained
A JSON Web Token packs three Base64url-encoded parts into one string: a header saying how it was signed, a payload of claims about the user and the session, and a signature. The first two are encoded, not encrypted, so anyone holding the token can read them. This decoder shows you exactly what they contain.
Key benefits
Common use cases
How to use it
- 1.Paste the token. Paste the whole token, including both dots. A leading “Bearer ” is stripped for you.
- 2.Read the status panel. It shows the signing algorithm, the key id if there is one, and whether the token has expired.
- 3.Check the claims. Standard claims appear first, with timestamps converted to real dates; anything custom follows.
- 4.Copy what you need. The header and payload each have a copy button for pasting into a ticket or a test.
The standard claims, explained
Most tokens carry a handful of registered claims. These are the ones you will see most often, and what each is actually for.
Key features
- Decodes the header, payload and signature separately
- Converts exp, nbf and iat into readable dates and relative times
- Flags an expired token, a token that is not valid yet, and alg: none
- Explains each registered claim next to its value
- Copy buttons for the decoded header and payload
- Works offline once the page has loaded
- No account, no upload, no storage
Decoding is not verifying
This is the single most important thing to understand about any JWT decoder, including this one. Decoding reads the Base64url and shows you the JSON. It proves nothing about whether the token is genuine. Anyone can craft a token that says "role":"admin" and it will decode perfectly here.
Only verifying the signature with the issuer’s key proves a token is authentic, and that belongs on your server, never in a browser tab. Treat what you see here as a readout for debugging, not as evidence. And because the payload is merely encoded, never put anything secret in it — a JWT is readable by anyone who has it. For the long version — the claims behind most 401s, algorithm confusion, and why a JWT cannot be revoked — read our guide to decoding and debugging JSON Web Tokens.
Frequently asked questions
What is a JWT?⌄
A JSON Web Token is a compact, URL-safe string with three Base64url-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims, and a signature. It is most often used as an access token or an identity token after a login.
Is it safe to decode a JWT here?⌄
Decoding happens entirely in your browser with JavaScript. The token is never sent to our servers, never logged and never written to browser storage. That said, a token is a live credential until it expires, so treat it like a password wherever you paste it.
Does this verify the signature?⌄
No, and no browser tool should. Verifying requires the issuer’s secret or public key, which belongs on your server. Decoding only shows what the token says; it cannot tell you whether the token is genuine or has been tampered with.
Why does my token show as expired?⌄
The exp claim is a Unix timestamp in seconds, and the token is invalid from that moment on. The status panel converts it to a real date and tells you how long ago it passed. A common cause of surprise expiry is a server clock that is out of sync.
Can I decode a token without the secret?⌄
Yes. The header and payload are encoded, not encrypted, so they can be read by anyone holding the token. The secret is only needed to check the signature, not to read the contents — which is exactly why you should never put sensitive data in a payload.