Quick answer: JWT Decoder is a free online tool that lets you paste any JSON Web Token to instantly see its header and payload claims, algorithm, and expiry status. The signature is never verified — this tool only decodes. Free with no signup or download: get results instantly, all inside your browser.
Paste any JSON Web Token to instantly see its header and payload claims, algorithm, and expiry status. The signature is never verified — this tool only decodes. Free, no signup, fully local.
What is the JWT Decoder?
A JWT (JSON Web Token) is three Base64URL-encoded segments joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries claims like subject, expiry, and roles, and the signature proves the token was issued by someone holding the secret key. This JWT decoder online tool splits a token apart and shows you exactly what is inside the first two segments.
Decoding is invaluable when debugging authentication: check whether the exp claim has passed, confirm the aud (audience) matches your API, verify the iss (issuer) is who you expect, and see which algorithm (alg) the token declares. The claims table lists every header and payload field with its value, including nested objects rendered as JSON.
Two important warnings. First, this tool never verifies the signature — decoding tells you what a token claims, not whether it is authentic. Second, never paste production tokens with real power into any online tool as a habit; here decoding is fully local so nothing leaves your browser, but treat tokens like passwords everywhere else.
One claim deserves special attention: aud. Multi-tenant APIs reject tokens whose audience does not match the service, and it is the most common cause of valid-token-but-401 mysteries. When debugging, compare aud against your API identifier character by character — a trailing slash or wrong environment name is all it takes.
How to use the JWT Decoder
Copy the full JWT from your Authorization header, cookie, or debugger.
Paste it into the input box — it should have two dots separating three segments.
Click Decode Token to split the header, payload, and signature.
Read the stat cards: structure validity, declared algorithm, and whether the token is expired.
Scan the claims table for sub, iss, aud, exp, iat, roles, and any custom claims.
JWT Decoder use cases
Debugging login failures
When authentication mysteriously fails, decode the token to check if exp is in the past, aud matches your API identifier, or the token was issued for a different environment.
Inspecting OAuth scopes
Access tokens from Auth0, Firebase, or Cognito carry scopes and roles as claims. Decode them to confirm the user actually received the permissions your code checks for.
Verifying token contents in tests
Integration tests that mint tokens should assert on the claims. Decode a sample token here to see the exact claim names and value formats your assertions must match.
Learning JWT structure
Seeing header, payload, and signature laid out side by side is the fastest way to understand how JWTs work — including why the payload is readable by anyone (it is only Base64URL, not encrypted).
Tips
A JWT payload is readable by anyone — never put sensitive personal data in claims.
An ‘expired’ result compares the exp claim to your device clock; clock skew can cause false positives.
If the structure is invalid, check for truncated tokens or missing dot separators when copying.
Decoding is not verification: always validate signatures server-side with the proper key.
Frequently asked questions
Does this tool verify the JWT signature?
No — and that is by design. This is a decoder, not a validator. It shows you what the token claims. Signature verification requires the secret or public key and must happen on your server, never in a browser tool. Decoding is always safe to do — it only reads the token’s claims. The dangerous operation would be trusting those claims without verifying the signature server-side.
Why does it say my token is expired?
The payload’s exp claim (a Unix timestamp) is earlier than the current time on your device. Tokens commonly live for minutes to hours; refresh the token or check whether your system clock is wrong. Short-lived access tokens expiring is normal behavior — request a fresh token from your auth server. If your clock is correct and tokens die instantly, the auth server’s expiry window may simply be very short — common for high-security APIs.
What do the standard claims mean?
Common registered claims: iss (issuer), sub (subject, usually the user ID), aud (audience), exp (expiry), iat (issued-at), and nbf (not valid before). Anything else in the payload is a custom claim defined by whoever issued the token. The exp and iat values are Unix timestamps in seconds; the tool converts them to readable dates automatically. Custom claims can carry anything from roles to tenant IDs.
Is it safe to paste my token here?
Decoding runs entirely in your browser — the token is never uploaded, stored, or logged. Still, treat tokens like passwords as a habit: prefer decoding test tokens, and revoke any production token you paste anywhere outside your own systems. A leaked production token lets anyone impersonate the user until it expires or is revoked. When in doubt, rotate it — revocation is cheap, breaches are not.
Why does decoding fail with ‘invalid structure’?
A JWT must be exactly three Base64URL segments separated by two dots. Failure usually means the token was truncated while copying, wrapped across lines, or is not a JWT at all. Make sure you grabbed the full continuous string with both dots. JWTs are also commonly corrupted by line wrapping in terminals and log viewers. Pasting into a plain-text field first, then copying from there, avoids most issues.
What does the ‘alg’ value tell me?
The header’s alg claim names the signing algorithm, such as HS256 or RS256. Your server must verify the signature with the matching key type — and should reject tokens declaring alg: none. Pin the expected algorithm server-side rather than trusting whatever the token declares. The ‘none’ algorithm attack — where a forged token declares no signature — is a classic JWT vulnerability. Proper servers reject such tokens outright.
Can I decode the signature segment too?
The signature is raw cryptographic output, not JSON, so there is nothing meaningful to decode. The tool shows its presence and length but does not try to interpret it. Signature verification belongs in your backend code with the proper cryptographic library. What you can inspect is the header and payload — the two JSON segments. The signature’s job is verification, not information, so there is nothing to ‘read’ in it.