JWT Decoder
Paste a JWT and instantly inspect its header and payload — decoding only.
The JWT Decoder splits a JSON Web Token into its three parts and pretty-prints the header and payload so you can inspect claims like issuer, expiry and user id in seconds. It decodes Base64URL segments with full Unicode support and flags expired tokens. The signature is NOT verified — this is for inspection, not authentication.
Note: the signature is NOT verified — this tool decodes the token only.
How to use the JWT Decoder
- Paste the full JWT (three dot-separated parts) into the text box.
- Click Decode Token to see the pretty-printed header and payload, plus an expiry check.
- Use Copy Payload to copy the payload JSON, or Clear to reset.
JWT Decoder — FAQs
Is the JWT decoder free?
Yes, completely free with no signup and no limits. Decode as many tokens as you need, any time, directly in your browser, which is especially useful when debugging authentication flows during API development work every day.
Does this tool verify the JWT signature?
No. The tool clearly states that the signature is NOT verified — it only decodes the Base64URL header and payload for inspection. Anyone can decode a JWT, so never treat a decoded token as proof it is authentic without verifying the signature server-side.
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser, so your tokens never leave your device. That said, JWTs can contain sensitive claims, so avoid pasting production tokens into any website or tool you do not fully trust.
What claims can I inspect?
Common claims include sub (subject), iss (issuer), aud (audience), iat (issued at) and exp (expiry). The tool pretty-prints every claim in the payload and clearly tells you whether an exp timestamp is already expired or still valid right now.