Developer Tool

JWT decoder

Decode a JSON Web Token to inspect its header, payload, and claims — private, instant, and processed entirely in your browser. Your token is never sent to a server.

Token

Paste a token — it decodes as you type.

Decoded

Header 

Payload
Registered claims
  • Decode a token to read claims…
Signature
 Signature is shown as-is. This tool decodes tokens; it does not verify the signature (that needs the secret / public key). 
All tools
Decode JSON Web Tokens (JWT) in your browser
Paste a JSON Web Token to read its header and payload, inspect standard claims, and check whether it has expired — all locally. Nothing is uploaded, so it is safe to inspect access tokens and ID tokens while debugging APIs and logins.
What the decoder shows
  • Header — the signing algorithm (alg) and token type (typ).
  • Payload — every claim in the token, pretty-printed.
  • Registered claims — iss, sub, aud, exp, nbf, iat, jti, with timestamps shown as readable dates.
  • Expiry status — whether the token is within its validity window.
Useful workflows
  • Debug OAuth / OpenID Connect logins and 401 responses.
  • Confirm exp / nbf when a token is rejected as expired or not yet valid.
  • Base64URL-decode segments by hand alongside the hash & encode generator, or pretty-print the payload with the JSON beautifier.
Frequently asked questions
Is my token sent to your server?
No. Decoding happens entirely in your browser with JavaScript — the token never leaves your device. Still, avoid pasting production secrets on shared computers.
Does this verify the signature?
No. This tool decodes the token so you can read it; verifying the signature requires the secret (HMAC) or public key (RSA/EC), which you should never paste into a public tool.
Why can't it read my token?
A standard JWT has three dot-separated segments (header.payload.signature). Five segments means an encrypted JWE, which cannot be decoded without keys.