JWT Decoder — Free Online Decoder
Decode and inspect JWT tokens
All processing happens locally. No data is sent to any server.
JSON Web Tokens (JWT) are a widely used standard for securely transmitting information between parties as a JSON object. Our JWT Decoder lets you quickly inspect the contents of any JWT token. Paste your JWT token into the input field, and instantly see the decoded header, payload, and signature. The decoder automatically detects the algorithm used (such as HS256, RS256, or ES256) and shows you whether the token has expired. You can also view the issued-at (iat), not-before (nbf), and expiration (exp) timestamps in both human-readable and Unix formats for easy verification. This is especially useful for debugging authentication issues, inspecting tokens from API responses, or verifying token contents during development and testing. If you're building an API that returns JWTs, this tool helps you validate that your tokens contain the correct claims and are signed with the expected algorithm. You can verify audience (aud), issuer (iss), and subject (sub) claims to ensure your tokens are properly scoped and secure. The tool also shows the raw header and payload JSON for detailed inspection and debugging. For related encoding tasks, check out our [Base64 Encoder/Decoder](/tools/base64) — JWTs use Base64URL encoding for their header and payload segments. You can also format the decoded JSON with our [JSON Formatter](/tools/json-formatter).
FAQ
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. It consists of three parts: header, payload, and signature.
How do I decode a JWT?
Simply paste the full JWT token into the input field. The decoder will automatically show you the decoded header, payload, and signature.
Is my token data safe?
Yes. All decoding happens in your browser. The token is never sent to any server. Your data never leaves your browser.
What does "expired" mean?
JWT tokens can have an expiration time (exp claim). If the current time is past the expiration, the token is considered expired.