JWT Decoder
JWT Decoder is a free developer tool that runs directly in your browser with no account required.
About this tool
Paste a JSON Web Token to inspect its header and payload as formatted JSON, along with the algorithm, subject, issuer, audience, and a human-readable expiry status. A timeline shows issued-at, not-before, and expiry claims as ISO timestamps, and the decoded token can be downloaded as JSON.
How to use
- Paste the full token into the JWT field.
- Read the claim summary metrics and the expiry status (valid or expired with the ISO time).
- Inspect the formatted Header and Payload panels and the claim timeline.
- Click Download decoded JWT to save the header and payload as a JSON file.
Frequently asked questions
Does this verify the token's signature?
No, and this is important: the tool only Base64URL-decodes the header and payload for inspection. It cannot tell you whether a token is authentic or tampered with; signature verification requires the signing key on your server.
How is expiry determined?
The exp claim is compared with your device's current time and shown as "valid" or "expired" alongside the exact ISO 8601 timestamp. iat and nbf claims are listed in the timeline the same way.
Why does my token fail to decode?
The input needs at least two dot-separated Base64URL segments (header.payload). Truncated tokens, extra whitespace, or segments that are not valid Base64URL JSON produce an error.
Is it safe to paste a live production token here?
Decoding happens entirely in your browser with no upload, so the token is not transmitted by this tool. Still, treat live tokens as credentials: prefer expired or test tokens when possible.
Does it support JWE (encrypted tokens)?
No. JWE payloads are encrypted rather than just encoded, so there is nothing readable to display. This tool is for standard signed JWTs (JWS).