Free JWT Decoder
Paste a JWT to inspect its header and payload, decoded entirely in your browser. This tool does not verify the signature.
How to decode a JWT
-
1
Paste the token
Paste the full encoded JWT — header, payload, and signature — into the input box.
-
2
Read the decoded output
The header and payload are decoded and pretty-printed as JSON automatically as you type.
-
3
Check the expiry
If the payload includes an exp claim, its human-readable expiry time is shown beneath the payload.
Example use cases
Debugging an auth flow
Inspect the claims inside an access or ID token to confirm the right user, scopes, or expiry were issued.
Checking token expiry
Quickly see whether a token has expired without writing a script to decode and convert the exp claim yourself.
Reviewing third-party API tokens
Decode a JWT handed to you by a client or vendor to see what data it actually carries before you rely on it.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, URL-safe token format made of three Base64URL-encoded parts separated by dots: a header, a payload, and a signature, commonly used for authentication and authorization.
Does this tool verify the signature?
No. It only decodes the header and payload so you can inspect their contents — it doesn't check the signature against a secret or public key, so a decoded token isn't proof it's valid or untampered.
Is my token uploaded anywhere?
No. Decoding happens locally in your browser using JavaScript — the token you paste is never sent to a server.
Why does it show an "Expired" or "Expires in" note?
If the payload has a standard exp claim, this tool converts it from a Unix timestamp to a readable date so you can quickly see whether the token has expired.
What if decoding fails?
A JWT needs exactly three dot-separated Base64URL segments. If your input is missing a segment or contains invalid Base64URL characters, you'll see an "Invalid JWT" message.