JWT Decoder
Decode JSON Web Tokens to inspect the header, payload, and signature. Check expiration and claims instantly.
About JWT Decoder
JSON Web Tokens are everywhere in modern auth — API authentication, single sign-on, mobile session management, OAuth flows — but they are notoriously opaque. A JWT looks like a meaningless base64-encoded string, when in fact it contains structured data you can read at a glance. This decoder splits any JWT into its three parts (header, payload, signature) and shows you the decoded contents in a structured view, so you can verify which claims are present, when the token expires, and which algorithm signed it.
Common situations where this saves time include debugging why an authenticated request is failing, confirming that custom claims propagated correctly through an OAuth flow, and inspecting expired tokens during incident review. The decoder never verifies the signature against a key — that requires server-side knowledge — but it surfaces every other detail useful for debugging.
How to Use
Paste your JWT (the long base64 string) into the input box.
Click 'Decode' to parse the token.
View the decoded header (algorithm, type) and payload (claims, expiration).
Timestamps like iat, exp, and nbf are automatically converted to readable dates.
Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three parts: a header (algorithm info), a payload (the claims/data), and a signature (for verification).
Does this verify the JWT signature?
No. This tool only decodes and displays the token contents. Signature verification requires the secret key or public key, which should never be shared in a browser tool. Use this for inspection and debugging only.
Is my JWT sent to any server?
No. All decoding happens in your browser. Your token never leaves your device. However, never paste production tokens with sensitive data into any online tool — this is for development and debugging only.
What do iat, exp, and nbf mean?
iat = Issued At (when the token was created), exp = Expiration Time (when it expires), nbf = Not Before (token is not valid before this time). All are Unix timestamps.
JWT Decoder: Decode JSON Web Tokens Online (Free, Secure)
JWTs are everywhere in modern auth — but decoding one shouldn't require pasting it into a sketchy website. Learn how JWTs work and decode them safely in your browser.
Read the full guide