JWT Decoder

Paste a JSON Web Token and instantly decode it into readable JSON with this free online JWT decoder. It splits the token on the dots and base64url-decodes the header and payload so you can inspect the algorithm, claims like sub, iat and exp, and see whether the token is still valid or expired. Everything runs 100% in your browser — your JWT is never uploaded to a server, making this a safe, private way to debug tokens. There is no sign-up, no limits, and no backend. Ideal for developers troubleshooting authentication, API access tokens, and OAuth flows.

🔒 100% private — files never leave your device

Loading…

How to use

  1. Paste your JSON Web Token into the input box.
  2. The decoder splits it on the dots and base64url-decodes it.
  3. Read the pretty-printed header and payload JSON below.
  4. Check the expiry status and copy the header or payload with one click.

Frequently asked questions

What is a JWT and what does this tool decode?

A JWT (JSON Web Token) is a compact, dot-separated token with three parts: header, payload, and signature. This tool base64url-decodes the header and payload and pretty-prints them as JSON so you can read the claims. It does not touch or expose the raw signature.

Is my token uploaded or stored anywhere?

No. Decoding happens entirely in your browser using JavaScript — your JWT is never sent to a server, logged, or stored. This makes it safe to inspect real access tokens without leaking sensitive data.

Does it verify the JWT signature?

No. This is a decoder, not a validator. It reads the header and payload but performs no signature verification, so it cannot confirm the token is authentic or untampered. Never trust a decoded token as proof of validity.

How does it show whether a token is expired?

If the payload contains an exp claim (a numeric Unix timestamp), the tool converts it to a readable date and compares it to your current time, marking the token as valid or expired. Tokens without an exp claim simply show no expiry status.

Can I copy the decoded output?

Yes. Each of the header and payload has its own copy button that puts the pretty-printed JSON on your clipboard. If clipboard access is blocked, the text is selected so you can copy it manually.

What if the token is invalid or malformed?

If the token is missing parts, has bad base64url segments, or the decoded data is not valid JSON, the tool shows an invalid-token notice instead of output. Make sure you paste the full token, including the header and payload segments separated by dots.

About this tool

Free online JWT decoder that runs 100% in your browser. Paste a JSON Web Token to inspect its header, payload, claims and expiry as readable JSON. Nothing uploaded.

Related tools