🔑 JWT Decoder
Decode and inspect JSON Web Tokens. Nothing leaves your browser.
Free JWT Decoder
Instantly decode and inspect JSON Web Tokens (JWTs). View the header algorithm, all payload claims, and check token expiration status. Color-coded token visualization shows header, payload, and signature sections. Recognizes standard claims like iss, sub, aud, exp, nbf, iat, and jti. Perfect for debugging authentication and API integrations. All processing happens in your browser -your tokens are never sent to any server.
What is a JWT Decoder?
A JWT decoder is a tool that breaks apart a JSON Web Token (JWT) and displays its contents in a readable format. JWTs are compact, URL-safe tokens used for authentication and information exchange in modern web applications. A JWT consists of three parts separated by dots: a header that specifies the signing algorithm, a payload that contains claims (key-value data like user ID, roles, and expiration time), and a signature that verifies the token's integrity. Each part is Base64URL-encoded, which makes the raw token difficult to read without decoding.
This free online JWT decoder instantly parses any JWT and shows you the header, payload, and all claims in a clear, organized layout. It checks whether the token has expired and displays color-coded status indicators. The tool is invaluable for developers building authentication systems, debugging OAuth2 flows, troubleshooting API authorization issues, or simply inspecting tokens received from third-party identity providers. Because decoding happens entirely in your browser, your tokens are never transmitted to any server.
How to Use This Tool
- Paste your JWT token into the text area at the top. The tool auto-decodes on paste, or you can click "Decode" manually.
- Review the color-coded token visualization showing the header (red), payload (purple), and signature (green) sections.
- Check the expiration status banner to see whether the token is still valid or has expired, along with the exact expiration timestamp.
- Scroll down to inspect the decoded header JSON, payload JSON, and the full claims table with human-readable labels and formatted timestamps.
Key Features
- Color-Coded Visualization - The encoded token is displayed with distinct colors for the header, payload, and signature, making it easy to identify each section at a glance.
- Expiration Status Check - Automatically compares the exp claim against the current time and shows a clear banner indicating whether the token is valid or expired.
- Human-Readable Claims - Standard claim names like iss, sub, aud, exp, iat, and nbf are displayed with their full labels (Issuer, Subject, Audience, etc.) for easy interpretation.
- Timestamp Formatting - Unix timestamps in claims like exp, iat, and nbf are converted to local date-time strings with relative time indicators (for example, "2h ago" or "in 3d").
- Privacy-First Design - Your JWT is decoded entirely in the browser. No data is sent to any server, making this tool safe to use with production tokens.
Frequently Asked Questions
Does this tool verify the JWT signature?
No. This tool decodes the token and displays its contents, but it does not verify the cryptographic signature. Signature verification requires the secret key (for HMAC algorithms) or the public key (for RSA or ECDSA algorithms), which should never be entered into a web tool. Use your server-side application or a trusted library to verify signatures.
Is it safe to paste my production JWT here?
Yes. All decoding happens locally in your browser using JavaScript. The token is never sent to any external server. You can verify this by opening your browser's developer tools and monitoring the Network tab while using the tool. No requests are made when you decode a token.
What are the three parts of a JWT?
A JWT has three Base64URL-encoded parts separated by dots. The header contains metadata like the signing algorithm (such as HS256 or RS256) and token type. The payload contains claims, which are statements about a user or entity (such as user ID, email, roles, and token expiration). The signature is created by combining the encoded header and payload with a secret key, and it ensures the token has not been tampered with.
Why does my token show as expired?
The tool compares the exp (Expires At) claim in the token's payload to your device's current time. If the current time is past the expiration timestamp, the token is marked as expired. Make sure your device clock is set correctly. Also note that many tokens are intentionally short-lived (15 minutes to a few hours) for security, so it is normal for previously valid tokens to expire.