JWT Decoder
Decode and inspect JWTs entirely in your browser — header, payload, expiry. Nothing leaves your device.
Paste a JWT above to inspect it
Header • Payload • Signature • Expiry — all decoded locally
Why you’ll love JWT Decoder
Instant & free
No signup, no paywall, no limits — JWT Decoder works the moment the page loads.
Completely private
Everything runs in your browser. Nothing you enter is ever uploaded or stored on a server.
Works on any device
Fully responsive and touch-friendly — use it on your phone, tablet or desktop.
Built by developers
Accurate, fast and keyboard-friendly — the details developers care about.
How to use it
Open it
No download and no login — the tool is ready right at the top of this page.
Use it
Enter your details or start interacting. Everything updates live as you go.
Get your result
Copy, download or share your result in a single tap. That’s it.
About JWT Decoder
A JSON Web Token is just three base64url-encoded segments separated by dots: header.payload.signature. Decoding the first two is pure text transformation — no secret key is involved — which is exactly what this tool does. Paste a token (a leading "Bearer " prefix from an Authorization header is stripped automatically) and it splits the segments into a colour-coded preview, pretty-prints the header and payload as syntax-highlighted JSON, and lays out the registered claims in a readable table.
Everything runs in your browser. The token is never transmitted, logged or stored on any server, so it is safe to inspect real production tokens. The decoder also never asks for your signing secret, because decoding is not verifying: anyone can read a JWT's payload, but only a party holding the secret or public key can confirm the signature is genuine. That distinction is why you should never put sensitive data in a JWT payload.
The time claims get special treatment. exp, nbf, iat and auth_time are converted from Unix seconds into readable dates — switchable between your local timezone and UTC — with relative phrasing like "expires in 42 minutes". A status badge tells you at a glance whether the token is valid, expired or not active yet, and a warning appears if the header declares alg: none, meaning the token is unsigned and trivially forgeable.
Popular uses
Frequently asked questions
Yes. The decoder is plain JavaScript running in your browser: the token never crosses the network, is not logged, and is not stored on any server. It is kept only in this tab's session storage so it survives a refresh, and the Clear button removes it. The one thing to avoid is sharing screenshots of a live access token, since anyone who copies it can replay it until it expires.
Decoding reverses the base64url encoding of the header and payload — anyone can do it, no key required, which is what this tool does. Verifying checks that the signature was produced with the correct secret (HMAC) or private key (RSA/ECDSA), and that requires the key material your server holds. A token that decodes cleanly can still be forged, so servers must always verify the signature before trusting any claim.
The exp claim is a Unix timestamp in seconds, and the badge compares it against your device's current clock. Access tokens are deliberately short-lived — often 5 to 60 minutes — so a token copied from an older request will usually read as expired. If a token shows "Not active yet" instead, its nbf (not-before) claim is in the future. A device clock that is badly off can also skew both results.
They are the registered claims from RFC 7519: iss identifies the issuer (usually your identity provider's URL), sub is the subject (the user or client the token is about), aud is the intended audience that should accept it, and jti is a unique token ID used to detect replays. The claims table labels each one and converts the time-based claims into readable dates so you do not have to decode Unix timestamps by hand.
The token's header declares no signature algorithm, so there is nothing cryptographic protecting its contents — anyone can mint or alter such a token. alg: none has been used in real-world attacks against libraries that accepted it as valid, which is why modern JWT libraries reject it by default. If you see this warning on a token from a live system, treat it as a security problem worth investigating.
JWT Decoder is 100% free — no signup, no watermarks and no usage limits. It’s one of 200+ free tools we build and give away.
Never. Everything is processed locally in your browser — safe for secrets, tokens and proprietary code.
More Developer Tools
From our collection of 317 free tools.
People also use
We built this. We can build yours.
JWT Decoder is one of 200+ free tools from Workaholic Developers — a software & AI studio. Need a website, app, AI agent or automation? Let’s talk.
🇮🇳 Built by Workaholic Developers
We built this little toy in days. Imagine what we’ll build for you.
AI agents, web apps, automation, custom tools — designed and engineered fast, on whatever tech fits the job. If you can describe it, we can build it.