Decode JWT Tokens Online
Decode JWT tokens online to inspect the header, payload, timing claims, and signature metadata in your browser. Paste a JSON Web Token and the tool splits it into its three parts — algorithm and type in the header, claims like sub, exp, iat, and any custom data in the payload — without verifying the signature or sending the token to a server.
How to use JWT Decoder
Paste content into the jwt input panel.
Run the tool to generate the decoded jwt.
Copy or download the result once it looks right.
Why this helps in real workflows
Debugging an auth flow where a token is present but the request is still being rejected.
Checking expiry claims (exp, iat, nbf) when a session is expiring sooner than expected.
Inspecting the algorithm field in the header to verify a token is signed correctly.
Reading a JWT payload from an API response without writing decoding code.
Common problems and fixes
The token looks valid but the API keeps returning 401.
Check the 'exp' claim in the payload — it's a Unix timestamp. If it's in the past, the token has expired. Also check 'nbf' (not before) if present.
The payload shows garbled text instead of JSON.
JWTs base64url-encode the payload. This decoder handles the encoding automatically, but if the output looks wrong, the token may be malformed or using a non-standard encoding.
I need to verify the signature, not just read the payload.
This tool only decodes — it does not verify signatures. Use your backend SDK or a tool like jwt.io with your secret key to verify the signature.
Related tools
Related Guides
Frequently asked questions
How do I decode a JWT?
Paste the token into the input box, run the decoder, and inspect the decoded header and payload sections.
Does this JWT decoder verify signatures?
No. It decodes and inspects the token structure locally, but it does not verify the JWT signature. For signature verification you need the secret or public key used to sign the token.
What are the three parts of a JWT?
Header (algorithm and token type), payload (claims like sub, exp, iat, and any custom data), and signature. All three are base64url-encoded and separated by dots.
Is it safe to paste a JWT into a browser tool?
This tool runs entirely in your browser — nothing is sent to a server. That said, avoid pasting production tokens with sensitive claims into any third-party tool as a general practice.
What does 'exp' mean in a JWT payload?
'exp' is the expiration time as a Unix timestamp (seconds since Jan 1 1970). Compare it against the current time to check if the token is still valid.
Is this JWT decoder free?
Yes. It is free to use in your browser.