Paste your token
Paste the full JWT, all three segments, into the input box.
DEVELOPER TOOLS · FREE ONLINE TOOL
JWT Decoder
Decode JSON Web Tokens and inspect their claimsDebugging authentication usually starts with one question: what is actually inside this token? Paste the full token and this decoder splits the three segments, pretty-prints the header and payload, and translates claims into plain language with real dates.
// JWT DECODER · GET STARTED
Use JWT Decoder
Decode JSON Web Tokens and inspect their claims
Advertisement
Decoded locally in your browser. The token is never uploaded.
Advertisement
How to use the JWT Decoder
Read header and payload
Read the decoded header and payload with claims in plain language.
Check expiry and claims
Check the expiry status and the converted iat, exp and nbf dates.
// JWT DECODER · ABOUT THIS TOOL
About the JWT Decoder
Debugging auth starts with one question: what is inside this token? The JWT Decoder splits it into header and payload, pretty-prints both, and translates the registered claims into plain language with real dates, so a wrong audience or an expired session is obvious. It deliberately does not verify signatures, and says so on screen. All parsing happens locally, so tokens never leave your machine.
Where it helps most
Where the diagnostic value lives.
Mysterious 401s
When an API keeps returning 401, this view reveals the cause in seconds: expired token, wrong audience, or unexpected issuer.
Expiry checks
Time-based claims are converted to readable dates and compared against the current time automatically.
Claim inspection
iss, sub, aud, exp, iat, nbf and jti explained in plain terms anyone can follow.
Token learning
See exactly what a token carries before trusting what it claims to be.
Using it safely
What it does not do.
No signature verification
Decoding shows what the token claims, not whether it is genuine; verification belongs on your backend with the real key.
Local parsing
All parsing happens locally in your browser, so the token never travels to a server.
Handle with care
A JWT is effectively a password; avoid pasting live production tokens into screenshots or chats, and revoke the session if one leaks.
JWT Decoder: private by design
Credential-grade privacy: parsing happens locally and the token never leaves your browser. No signup needed.
JWT Decoder FAQs
It splits the token into its three dot-separated parts and displays the decoded header, with the algorithm and token type, and the payload, with claims like subject, issuer, expiry, and any custom data. The first two parts are only base64url-encoded JSON, not encrypted, so anyone holding the token can read them.
tools-guide
SSL Certificate Checker: Verify Expiry and Validity Free
Free SSL certificate checker: verify any website's certificate issuer, expiry date, days remaining, covered domains and fingerprint. Avoid expiry outages.
Read article →
tools-guide
Technology Stack Detector: Reveal Any Website's Tech Stack
Discover the technology stack behind any website in seconds. Our free Technology Stack Detector uncovers CMS, frameworks, hosting, and analytics instantly.
Read article →