JWT Decoder
Paste a JSON Web Token to instantly view its decoded header and payload, check expiration and issue times, and inspect the signature — all locally in your browser.
Decode a tokenNo signup. No server calls. Works offline once the page loads.
Header
Payload
Signature
—
RSA/ECDSA-signed tokens (RS256, ES256, etc.) require a public key and cannot be verified here — only the signature's presence and encoding are shown.
How It Works
Paste your token
Drop any JWT into the input box above — the header, payload, and signature segments are separated automatically.
Instant decoding
The Base64URL segments are decoded and pretty-printed as JSON, with claim timestamps converted to readable dates.
Inspect & export
Review validity, expiration, and signature details, then copy or download the decoded JSON.
Privacy note: everything happens locally in your browser using JavaScript. No token, secret, or claim is ever sent to a server.
Common Uses
Debugging auth flows
Quickly inspect access and ID tokens issued by your auth provider to confirm claims and scopes.
Checking token expiration
See exactly when a token was issued and when it expires without writing any code.
API integration testing
Verify that a third-party API is issuing tokens with the expected claims and algorithm.
Learning JWT structure
A hands-on way to see how header, payload, and signature fit together in a real token.
Frequently Asked Questions
Is my JWT sent to a server when I use this tool?
No. Decoding happens entirely in your browser using JavaScript. The token you paste is never transmitted anywhere, which makes it safe to inspect tokens that contain sensitive claims.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way of representing claims to be transferred between two parties. It consists of three Base64URL-encoded parts separated by dots: a header, a payload, and a signature.
Can this tool verify the signature of my JWT?
Yes, for HMAC-signed tokens (HS256, HS384, HS512) you can enter the shared secret and the tool will verify the signature locally using the Web Crypto API. RSA and ECDSA signed tokens require a public key and are not verified by default.
Why does my token show as invalid?
A token is flagged invalid if it does not have exactly three dot-separated segments, if a segment is not valid Base64URL, or if the header/payload segments do not decode to valid JSON.
What do exp, iat, and nbf mean?
exp is the expiration time after which the token must not be accepted, iat is the time the token was issued, and nbf is the earliest time the token becomes valid. All three are Unix timestamps in seconds.
Can I decode an expired token?
Yes. Decoding only reads the contents of the token and does not check expiration by default — the tool decodes any structurally valid JWT and separately flags whether it is expired.
Does this tool support JWE (encrypted tokens)?
No. This tool decodes standard signed JWTs (JWS) with three segments. Encrypted JWTs (JWE) have five segments and their payload cannot be read without the decryption key.
More Tools
Want the full header/payload/signature breakdown? Read the JWT Anatomy Visual Guide →