JWT Token Decoder
Decode JWT headers, payloads, expiry times and claims right in the browser.
Encoded token
EmptyToken status
No token loadedHeader
Payload
All claims
0 claims| Claim | Value | Meaning |
|---|
How to decode a JWT token
Paste the encoded token
Copy the full compact token — header, payload and signature separated by dots — into the editor at the top.
Read the header and payload
Both parts are base64url-decoded and pretty-printed as JSON, with an algorithm and token type summary.
Check the expiry
The status panel shows the issued-at and expiry dates, whether the token is valid, expired or not yet valid, plus a live countdown.
Review every claim
The claims table lists each registered and custom claim with its raw value and a short explanation of what it means.
JWT decoder — frequently asked questions
No, and that is a security feature rather than a limitation to worry about. Decoding only reads the base64url segments. Signature verification needs the secret or public key and must happen on a server that you control — never paste production secrets into a web page.
A JWT payload is merely base64url-encoded, not encrypted. Anyone holding the token can read its contents, which is why you should never put passwords, card numbers or private keys in a JWT payload.
iss is the issuer, sub the subject (usually a user id), aud the intended audience, exp the expiry time, nbf the “not before” time, iat the issued-at time, jti a unique token id and typ the token type. Times are expressed as seconds since the Unix epoch.
Not directly. A JWE (encrypted JWT) has five dot-separated parts and its payload is encrypted, so there is simply nothing to read without the decryption key. This tool tells you when a token looks encrypted and asks you to paste a compact JWS instead.
No. Decoding runs entirely in your browser with atob and TextDecoder, so the token is never transmitted, logged or saved. Refresh the page and it is gone.
Related Developer Tools
JSON Formatter & Validator
Format, validate and minify JSON, with an expandable tree view of the structure.
Open toolBase64 Encoder / Decoder
Encode and decode text to and from standard or URL-safe Base64.
Open toolHash & Checksum Generator
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests instantly.
Open toolRegex Tester & Debugger
Test regular expressions with live match highlighting and capture groups.
Open toolUUID / GUID Generator
Generate random v4 UUIDs one by one or in bulk, with upper, lower and brace styles.
Open toolUnix Timestamp Converter
Convert Unix epoch seconds and milliseconds into readable dates and back.
Open tool