JWT Decoder
Decode and inspect JSON Web Tokens.
- Runs in your browser
- No signup
How to use JWT Decoder
Paste a token
Drop in a JSON Web Token (the header.payload.signature string). It is decoded in your browser.
Read header and payload
See the algorithm, token type and every claim, with standard claims labelled in plain English.
Check the dates
exp, nbf and iat are shown as readable dates, with a Valid or Expired badge.
How to decode a JWT (JSON Web Token)
JSON Web Tokens carry identity and permission data between apps and APIs. When a login fails or an API returns 401, looking inside the token is usually the fastest way to see why. JWT Decoder splits a token into its header and payload and explains every claim.
Anatomy of a JWT
A JWT is three Base64URL-encoded parts separated by dots. The header says which algorithm signed it (for example HS256 or RS256). The payload holds the claims: who the token is about, who issued it and when it expires. The signature proves the first two parts were not changed.
Standard claims
These registered claims are labelled automatically:
- iss (issuer): who created the token.
- sub (subject): usually the user ID.
- aud (audience): which service the token is meant for.
- exp, nbf and iat: expiry, not-before and issued-at times, shown as readable dates.
- jti: a unique ID for the token.
Security notes
Decoding is not verifying: this tool does not check the signature, which requires the secret or public key and should happen on your server. Remember that JWT payloads are only encoded, not encrypted, so anyone holding a token can read it; never put passwords or secrets inside. Tokens are decoded in your browser and never sent anywhere.