JWT Decoder
Decode and inspect JSON Web Tokens (JWT) instantly.
Paste Your JWT
Token Structure
..
Header
Payload (Claims)
Signature
Base64 Encoded:
Note: This tool decodes but does not verify signatures. To verify, you need the secret key or public key used to sign the token.
JWT Decoder — Inspect Any Token Instantly
JSON Web Tokens carry the identity and permissions behind most modern logins and APIs. This free JWT decoder splits any token into its header, payload and signature, pretty-prints the JSON claims, and flags expiry (exp), issued-at (iat) and not-before (nbf) timestamps in plain language.
Decoding is pure base64url parsing that runs entirely in your browser — the signature is displayed, not cryptographically verified, and your token is never sent anywhere. Load the sample token to explore the layout before pasting a real one.
Full token breakdown
See the three token segments color-coded, the decoded header and payload JSON side by side, and the raw signature — everything a debugger needs in one view.
Expiry and claim analysis
The tool translates standard claims like exp, iat and nbf into readable dates and warns you when a token is expired or not yet valid.
Private by design
Tokens often contain sensitive session data. Because decoding happens locally with zero network calls, you can safely inspect production tokens here without leaking them to a third-party service.
How to use
- Paste your JWT into the input box.
- Click Decode JWT.
- Read the header, payload claims and signature sections.
- Use Load Sample first if you want to explore with a demo token.
Frequently Asked Questions
What is a JWT?
A JSON Web Token is a compact, URL-safe token made of three base64url parts — header, payload and signature — separated by dots. Servers issue them after login so clients can prove who they are on each request.
Does this tool verify the signature?
No. It decodes and displays the signature, but cryptographic verification needs the secret or public key, which never leaves your server. Treat decoded output as informational only.
Is it safe to paste a production token here?
Yes. Decoding runs entirely in your browser — nothing is sent to any server. Still, never paste tokens into tools you do not trust; this one makes no network requests at all.
Why does my token show as invalid?
The most common causes are a truncated token (all three parts are required), extra whitespace, or characters altered when copying. Make sure the token has exactly two dots.
What do the exp, iat and nbf claims mean?
exp is when the token expires, iat is when it was issued, and nbf is the earliest time it becomes valid. The decoder converts all three into readable dates.
Related Developer Tools
Check Out Other Popular Tools
Calculatrice Hypothécaire Suisse
Calculez votre prêt immobilier en Suisse. Vérifiez votre tenabilité (affordability) avec le taux théorique de 5% et le ratio de nantissement (LTV).
Net Run Rate Calculator
Calculate Net Run Rate (NRR) for cricket tournaments. Track scenario-based NRR for T20 World Cup, IPL, and more with our live table.
Screenshot Beautifier
Make screenshots post-ready: gradient backdrops, padding, rounded corners, soft shadows and an optional browser frame. Free, in your browser, no upload.
Was this tool helpful?
Comments
Loading comments...