Developer / TOOLKIT
JWT Decoder
Decode and inspect JSON Web Tokens - header, payload and expiry, locally.
Free to use · No account needed
How to use
- Paste a JWT (three dot-separated parts) into the box.
- Click Decode - header and payload are pretty-printed as JSON.
- Claims like exp (expiry), iat and nbf are highlighted with their readable dates.
JWT (JSON Web Tokens) secure modern APIs and single sign-on. Decode the header and payload of any JWT to inspect its claims, expiry time and algorithm without touching the signature. Developers debugging authentication issues, or security reviewers auditing token expiry and permissions, use this to see exactly what a token contains.
Use cases
1. Use case: Debug authentication Inspect a JWT returned by your login endpoint to see the claims (user id, roles, expiry) without guessing.
2. Use case: Check token expiry Paste a token and instantly see whether the exp claim has already passed - useful when diagnosing 401 errors.
Practical tips
Decoding is not verification: this tool shows you the three base64url parts — header, payload, signature — but only the server holding the secret key can verify the signature. It runs locally, so pasting a token here does not transmit it anywhere; still, decoded payloads often contain user identifiers you should not share in screenshots. Check the exp and iat claims in human-readable form — expired-token bugs are the most common authentication mystery. A token with no signature part is unsigned (alg none) and should never be trusted. Like every tool on this site, the Jwt Decoder runs entirely in your browser: the data you enter never leaves your device, nothing is uploaded to a server, and the tool keeps working if your connection drops.
Common mistakes
Decoding reveals everything except the one thing people assume it proves:
- Assuming decoding verifies the token — only the server holding the secret key can verify the signature; this tool shows the parts, not validity.
- Sharing screenshots of decoded payloads, which often contain user identifiers, emails or internal claims.
- Overlooking an expired exp claim — expired tokens are the most common authentication mystery, and the human-readable view makes them obvious.
- Trusting a token with no signature part (alg none); such tokens should never be accepted by any system.
Frequently asked questions
Does the Jwt Decoder send my data anywhere?
No. It runs entirely in your browser — your input is processed on your device and never uploaded. Refresh the page and it still works offline.