JWT Decoder
Decode JWT tokens instantly and inspect headers, payload claims, and expiration with a secure browser-based JWT decoder.
Decode and inspect JSON Web Tokens (JWT) instantly with this secure browser-based JWT decoder. View the token header and payload to verify claims, expiration (exp), issuer (iss), and audience (aud). All decoding happens locally in your browser, so your tokens are never transmitted or stored. Developers often use JWT decoders to debug authentication flows, inspect API tokens, or verify user permissions during development.
About this tool
What is a JSON Web Token (JWT)?
A JSON Web Token (JWT) is a compact authentication token used to securely transmit information between systems. JWTs are commonly used in APIs and authentication systems to represent user identity and permissions.
- Used in OAuth and modern authentication systems
- Contains a header, payload, and signature
- Often used for API authentication and session management
Decode JWTs Safely
Decode JWT tokens and inspect their headers and payload claims. If the payload contains encoded strings, you can decode them using our Base64 Decoder tool.
- Decode header (alg, typ)
- Decode payload (claims like iat, exp, iss, aud)
- Human-readable date formatting
- 100% Client-side processing
When to Use a JWT Decoder
JWTs are the standard for modern authentication. Use this tool to debug login issues or verify token contents.
- Check if a token is expired
- Verify user roles and permissions
- Confirm issuer (iss) and audience (aud)
How to Use JWT Decoder
Paste Your JWT Token
Paste your encoded JWT token (often starting with `eyJ...`) into the input field.
Inspect Header and Payload Claims
The tool automatically splits the token into Header and Payload. Read the decoded JSON to verify the user ID, expiration time, and scopes.
Check JWT Expiration Time
Hover or look at the 'exp' (expiration) field to see exactly when the token becomes invalid in human-readable time.
Common questions
What is a JWT decoder?
A JWT decoder converts the Base64-encoded parts of a JSON Web Token into readable JSON. It allows developers to inspect the header and payload to understand token contents without verifying the signature.
What is a JSON Web Token used for?
JWTs are widely used for authentication and authorization in modern web applications. They are commonly used in APIs, OAuth systems, and identity providers to securely transmit user identity and permissions.
Is it safe to paste production tokens here?
This JWT decoder runs entirely in your browser using client-side JavaScript. Your token is not transmitted, logged, or stored on any server.
Can I verify the signature?
No. Signature verification requires your private secret key or public certificate. To keep your secrets safe, we do not ask for them and therefore cannot verify the signature.
What happens if the token is expired?
The tool will still decode it so you can see why it expired (by checking the 'exp' claim), but the token itself would be rejected by your API.
What is the difference between decoding and verifying a JWT?
Decoding a JWT simply converts the Base64-encoded header and payload into readable JSON. Verifying a JWT checks the signature using a secret key or public key to ensure the token has not been tampered with. This tool only decodes tokens and does not perform signature verification.
Does this handle encrypted JWTs (JWE)?
No, this tool only supports standard signed JWTs (JWS). Encrypted tokens require a decryption key, which is not supported in this public tool.
Can I decode a JWT without the secret key?
Yes. Decoding does not require a secret key because it only reads the Base64-encoded header and payload. After decoding, you can format the JSON payload using our JSON Formatter to make the claims easier to read.
Why is the output just random characters?
Ensure you pasted the full token including the dots (.). If the token uses a non-standard encoding, it might not decode correctly.
Related tools
JSON Formatter & Validator
Validate, format, and minify JSON instantly with live syntax feedback.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 strings instantly with a secure browser-based encoder and decoder.
URL Encoder / Decoder
Encode or decode URLs and query parameters instantly using a secure browser-based URL encoder and decoder.