JWT Decoder
Decode a token's header & payload.
JWT Decoder at a glance
JWT Decoder is a free online developer tool you can use right now to decode a token's header & payload โ no account, no install and no usage limit. It runs entirely inside your browser, so whatever you enter stays on your own device.
- Price
- Free โ no trial, no paid tier, no watermark
- Sign-up
- Not required
- Where it runs
- In your browser โ nothing is uploaded to a server
- Works on
- Chrome, Safari, Firefox and Edge โ desktop, tablet and phone
- Category
- Developer Tools
โ ๏ธ Decoding does not verify the signature. Never paste production secrets.
About JWT Decoder
A JSON Web Token is three base64url-encoded sections joined by dots: a header describing the signing algorithm, a payload carrying the claims, and a signature. Paste a token here to read the first two in plain JSON.
The most important thing to understand about JWTs is that the payload is encoded, not encrypted. Anyone holding the token can read every claim in it โ no key required, which is exactly what this tool demonstrates. That makes JWTs unsuitable for carrying anything confidential. A user id or a role is fine; an email address is a judgement call; a password or an internal secret never is.
The claims worth checking first when debugging are the timestamps. exp is expiry and iat is issued-at, both as Unix seconds rather than milliseconds. An expired token is by far the most common cause of an authentication failure that appeared to work moments earlier. Also check iss and aud โ a token issued by the right service but intended for a different audience will be rejected by a correctly configured verifier.
This tool decodes; it does not verify. Verification requires the signing secret or public key, and pasting a signing secret into any web page would be a serious mistake. A decoded token tells you what it claims to be, never whether that claim is authentic โ that check belongs on your server.
How to use JWT Decoder
- Paste the full token, including both dots and all three sections.
- Read the decoded header and payload as formatted JSON.
- Check exp against the current time to confirm whether the token is still valid.
Frequently asked questions
Does this verify the token signature?
No, and no browser tool safely can. Verification needs the signing secret or public key, which should never be pasted into a web page. This decodes the header and payload so you can inspect claims and expiry. Signature verification belongs in your backend.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and the token is never transmitted. That said, a valid token is a live credential โ treat it as you would a password, and prefer expired or test tokens when you have the choice.
Why can anyone read my JWT payload?
Because JWTs are signed, not encrypted. The signature proves the contents were not altered; it does not hide them. Base64url is an encoding, not a cipher. Never put anything confidential in a JWT payload.
My token looks valid but is rejected โ why?
Check exp first, since expiry is the usual cause. After that, confirm iss and aud match what the verifying service expects, and check for clock skew between servers โ a token issued seconds in the future by a fast clock will fail an iat check.