JWT Decoder

JWT Decoder

The JWT decoder splits a JSON Web Token into its three parts and decodes the header and payload into readable JSON, showing you the claims and expiry at a glance. JWTs are the backbone of modern auth flows, but the raw dotted string is opaque. Paste a token here to see the algorithm, issuer, subject, scopes, and timestamps without writing a line of code.

How it works

Decoding runs entirely in your browser with JavaScript. The tool Base64URL-decodes the header and payload segments and formats the resulting JSON, and it surfaces standard time claims like exp, iat, and nbf so you can tell whether a token is expired. Nothing is uploaded, which matters because tokens are sensitive credentials that should never be pasted into a remote service.

Practical use cases

• Check whether an access token has expired during debugging.
• Inspect the claims and scopes a token carries for an API request.
• Verify the issuer, audience, and subject in an auth integration.
• Learn how a JWT is structured while studying authentication.

To decode individual token segments manually, use Base64 Encode / Decode. For the human-readable dates behind the timestamps, the Unix Timestamp Converter helps, and you can pretty-print the payload with the JSON Formatter.

Private by design

Because decoding happens in-browser, your token is never uploaded, so its secrets stay with you. The tool only decodes and does not verify signatures, since verification would require your secret key. It is free, needs no account, and works on all modern browsers including mobile, so you can inspect JWTs safely anywhere.