Free JWT Decoder Tool Online
Decode JSON Web Tokens to inspect the header and payload instantly in your browser. See claims like expiry and issuer without a server call.
IN: JWT string · OUT: Header & payload JSON · RUNS: 100% in your browser
Frequently asked questions
Does this tool verify the JWT signature?+
No, it only decodes and displays the header and payload. Signature verification requires the secret or public key, which this tool does not request, for your safety.
Is my token sent to a server?+
No. Decoding happens entirely client-side in your browser; your token is never transmitted or logged.
Why shouldn't I paste production tokens into online tools?+
As a general security practice, avoid pasting live production tokens into any third-party site. This tool works fully offline in your browser, but using a local or expired token for testing is still good hygiene.
What does the 'exp' claim mean?+
The exp claim is a Unix timestamp indicating when the token expires. This tool automatically converts it to a readable date for you.
What's the difference between the header and payload?+
The header typically specifies the signing algorithm (like HS256 or RS256) and token type; the payload contains the actual claims — data like user ID, expiry, issuer, and any custom fields the issuer included.
Why does decoding fail with 'Invalid Base64URL' errors?+
A valid JWT has exactly three dot-separated segments, each Base64URL-encoded. If you accidentally copied extra whitespace, a partial token, or a non-JWT string, decoding will fail — check that all three segments are intact.
Are all three JWT segments always human-readable JSON?+
The header and payload decode to JSON, but the third segment (the signature) is raw cryptographic bytes, not JSON, so this tool displays it as-is rather than trying to parse it.
Can anyone read the contents of a JWT?+
Yes, standard JWTs are only Base64URL-encoded, not encrypted, so anyone with the token can decode the payload just like this tool does. Never put sensitive secrets directly in a JWT payload unless you're using an encrypted JWE variant.