Free Online JWT Decoder
Decode a JWT header and payload without verifying the signature.
A JWT is three Base64URL segments separated by dots: header, payload, and signature. Decoding is not verification, so treat the contents as untrusted until the signature is checked by your server.
About the JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It is defined by
RFC 7519 and is widely used for authentication, API access, and single sign-on. A JWT looks like three
Base64URL-encoded parts joined by dots: header.payload.signature. This tool decodes the header and
payload in your browser so you can inspect the data without sending the token to a server.
What each part contains
- Header: JSON that usually describes the signing algorithm (
alg) and token type (typ). - Payload: JSON claims such as
sub(subject),iat(issued at),nbf(not before), andexp(expiration), plus any custom fields. - Signature: a cryptographic value produced with the header, payload, and a secret or private key. It proves the token was created by someone holding that key.
Base64URL is an encoding, not encryption. Anyone holding a JWT can read the header and payload, so never put
passwords, API keys, or personal secrets inside a token. The signature protects integrity, not confidentiality.
This decoder deliberately does not verify signatures, which means a token can be perfectly readable and still be
forged. Your backend must verify the signature with the correct key, validate the algorithm, and check
exp, nbf, iss, and aud before trusting any claim.
How to use this tool
- Paste a token, including or omitting the
Bearerprefix. - Read the decoded header, payload, and signature. Timestamps are converted to local dates.
- Check the status badge for expired, not-yet-valid, or valid timing.
- Copy or download the decoded JSON for debugging.
Frequently asked questions
Can this tool verify my JWT signature?
No. Verification needs the signing secret or public key, and doing it safely belongs on a trusted server. This tool only decodes the segments.
Why does a valid token show as expired?
The exp claim is a NumericDate in seconds since the Unix epoch. If that moment has passed in your local clock, the token is expired, even if it still appears in a client.
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser with JavaScript. The token never leaves your device.