JWT Decoder - Inspect JSON Web Tokens Online

Decode JSON Web Tokens directly in your browser.

No signup
Local-first
Free limit: Text input

Preparing the editor...

The guide and instructions on this page are available while the tool loads.

Continue your workflow

The tool can reveal common fields such as algorithm, token type, subject, issuer, audience, and expiration timestamps without needing a backend or external service.

It is important to remember that decoding is not the same as verification. A decoded JWT may still be invalid, expired, unsigned correctly, or unsafe to trust.

Common uses for JWT Decoder

Typical tasks this tool is built for.

Inspect JWT payload claims during authentication debugging.
Inspect expiration and issued-at timestamps.
Read token headers to confirm algorithm and token type.
Understand what a token contains before sending it to an API.

How to use JWT Decoder

Step 1. Paste a token with three dot-separated segments in header.payload.signature order.
Step 2. Select Decode token and read the parsed header, including fields such as alg and typ when they are present.
Step 3. Review the payload JSON and its claims, such as sub, iss, aud, iat, or exp, when the token supplies them.
Step 4. Use the summary to inspect iat and exp; the expiration status is calculated from exp only.
Step 5. Use Copy header or Copy payload to copy that decoded JSON when the browser clipboard control is available.
Step 6. Keep verification separate: decoding reveals encoded content but does not check the signature.

Why use this tool?

Decode Base64URL JWT header and payload segments into readable JSON.
Show the signature segment separately without treating its presence as verification.
Display common header and payload fields such as alg, typ, sub, iss, aud, iat, and exp.
Show an expiration status based on the numeric exp claim and the current Unix time.
Copy the decoded header or payload JSON with their separate Copy controls.

Privacy and formats

JWT decoding runs locally in your browser. Tokens are not sent to DevToolKit servers — still avoid pasting production credentials on shared devices.

Input: TextOutput: Decoded headerOutput: Decoded payload

Best results with JWT Decoder

Practical tips before you download or share the output.

Decoding a JWT does not verify its signature. Use proper backend verification before trusting token content.

Related guides

Longer reads that pair well with this tool.

Developer guide

Useful Developer Tools Every Browser Should Have

Fourteen In-browser developer utilities for JSON, encoding, tokens, diffs, hashes, regex, SQL, UUIDs, and timestamps — fast checks without installing anything.

Developer guide

How to Format JSON Online

Use automatic JSON.parse and JSON.stringify formatting, inspect strict-JSON parser errors, and review indented text up to 1,000,000 characters.

Developer guide

How to Redact and Review Sensitive JSON

Reduce exposure while reviewing sensitive JSON by using synthetic data, redacting credentials and identifiers, and checking browser, screen, and clipboard risks.

Related tools

Common next steps after using this tool.

JSON Formatter

Automatically format and validate JSON in your browser.

QR Code Generator

Create QR codes for URLs, plain text, email, phone numbers, and Wi-Fi credentials in your browser.

Password Generator

Generate strong random passwords directly in your browser.

Base64 Encoder/Decoder

Encode and decode Base64 text directly in your browser.

SQL Formatter

Format or minify SQL queries directly in your browser.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes in your browser.

Common problems this tool helps with

Situations where this workflow saves time.

The token is rejected before decoding - the input must contain exactly three dot-separated segments.

A header or payload segment cannot be decoded - only those two segments are Base64URL-decoded and JSON-parsed; the signature is displayed as encoded text and is not decoded or verified.

A signature needs interpretation - a non-empty segment is displayed as text, an empty segment is labeled missing, and neither state is verified.

The expiration status is unexpected - a missing exp produces “No expiry claim,” a non-numeric or non-finite exp produces “Invalid token,” and a numeric exp is compared with the current Unix time.

The expiration date looks unexpected - exp is interpreted as Unix seconds and displayed with the browser’s locale formatting.

An expired label surprises you - the component compares exp with the current Unix time when decoding.

You need not-before handling - the summary and status do not inspect or enforce nbf.

Decoded claims appear trustworthy - decoding alone never establishes that a token is authentic.

Frequently asked questions

Does decoding verify the JWT?

No. It only decodes the header and payload. Signature verification requires the appropriate issuer key or secret in a trusted verification flow.

What token structure can the decoder read?

It requires exactly three dot-separated segments: encoded header, encoded payload, and signature. A token with fewer or more segments produces an input error.

How are Base64URL characters handled?

Before decoding, the component converts - and _ back to Base64 characters and adds required padding. The decoded header and payload must still parse as JSON.

Which time claims appear in the summary?

The summary shows iat and exp when those claims are present and usable. Other payload claims remain available in the decoded payload JSON.

How are JWT dates displayed?

Numeric iat and exp values are treated as Unix seconds and formatted with the browser’s date and locale formatting.

What determines the expiration status?

Only the numeric exp claim. The component compares exp with the current Unix time; it does not use iat or nbf for the status label.

Does the decoder inspect nbf?

No. An nbf property may remain visible in the raw decoded payload JSON, but the summary and expiration-status logic do not interpret, check, or enforce it.

Can I copy a decoded value?

Yes. The header and payload cards each have a Copy control that writes their formatted JSON text to the browser clipboard when that API is available.

Does a displayed signature prove the token is valid?

No. Showing the third segment does not check its cryptographic relationship to the header and payload or whether the issuer should be trusted.

Explore more in Developer

Browse related tools or open the full workspace.

Developer workspace All tools

How to use JWT Decoder

Step 1. Paste a token with three dot-separated segments in header.payload.signature order.

Step 2. Select Decode token and read the parsed header, including fields such as alg and typ when they are present.

Step 3. Review the payload JSON and its claims, such as sub, iss, aud, iat, or exp, when the token supplies them.

Step 4. Use the summary to inspect iat and exp; the expiration status is calculated from exp only.

Step 5. Use Copy header or Copy payload to copy that decoded JSON when the browser clipboard control is available.

Step 6. Keep verification separate: decoding reveals encoded content but does not check the signature.

Why use this tool?

Decode Base64URL JWT header and payload segments into readable JSON.

Show the signature segment separately without treating its presence as verification.

Display common header and payload fields such as alg, typ, sub, iss, aud, iat, and exp.

Show an expiration status based on the numeric exp claim and the current Unix time.

Copy the decoded header or payload JSON with their separate Copy controls.