Free Online JWT Decoder & Inspector
Paste a JSON Web Token to instantly decode its header and payload, see standard claims like issuer and subject highlighted, and check whether it's expired — all without the token ever leaving your browser. It helps developers inspect a bearer token during API debugging without attempting to verify a token signature or trust it.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims — statements about a user or session — that gets passed between two parties, most commonly used for authentication and authorization in web APIs. A JWT has three Base64URL-encoded segments separated by dots: a header (describing the signing algorithm), a payload (the actual claims), and a signature (proof the token hasn't been tampered with, verifiable only by whoever holds the signing secret or key).
How to decode a JWT online
Paste the full token — including all three dot-separated segments — into the input box and click Decode. The header and payload are decoded and pretty-printed instantly, standard claims like iss, sub, and exp are pulled out and highlighted with their meaning, and if the token has an expiration claim, you'll see whether it's currently active or expired and by how long.
Decoding vs. verifying
This tool decodes a JWT — it reads and displays the header and payload, which is possible for anyone since they're only encoded, not encrypted. It does not verify the signature, which would require the issuer's secret (for HMAC algorithms) or public key (for RSA/ECDSA algorithms). Never paste a production secret key into any online tool, including this one — decoding a token you already have doesn't require one.
Common use cases
- Debugging why an API call fails by inspecting the claims in the auth token being sent
- Checking whether an access token has expired without writing a script
- Understanding what data an identity provider (like Auth0, Firebase Auth, or a custom auth service) actually puts in its tokens
How to use JWT Decoder for related tasks
Paste the token, decode JWT header and payload sections, and check the expiration claim before investigating the API authorization flow.
Related tools: REST API Tester, Base64URL & Base32 Converter.
Frequently asked questions
Is my JWT uploaded anywhere when I decode it?
No — decoding happens entirely in your browser by Base64URL-decoding the token's two JSON segments. Nothing you paste is ever sent to a server, which matters since a real JWT often contains a live session or user identity.
Does this tool verify the JWT signature?
No, and that's intentional — verifying a signature requires the issuer's secret or public key, which isn't something a generic online tool should ask you for. This tool only decodes and displays the header and payload for inspection; it never validates the signature.
Why do I see "Expired" even though the token still works in my app?
Some applications don't enforce the exp claim strictly, or refresh tokens before they expire. The expiration status shown here is purely based on comparing the exp claim to the current time — it doesn't reflect how your specific application handles expired tokens.
What are iss, sub, aud, exp, and iat?
These are registered JWT claims defined by RFC 7519: iss (issuer) identifies who created the token, sub (subject) identifies the user or entity it's about, aud (audience) identifies who the token is intended for, exp (expiration time) and iat (issued at) are Unix timestamps marking when the token expires and was created.
What does this JWT token contain?
The decoder shows readable header and payload claims, but decoded content is not proof of authenticity; signature verification must happen with the issuer key.