JWT Decoder — Free, In Browser
Decode a JWT to inspect its header and payload. 100% in your browser — free, no sign-up, no upload.
- ✓Free
- ✓No sign-up
- ✓Runs in your browser — files never uploaded
- ✓No watermark
How to
- 1Paste a JWT — it is decoded in your browser and never uploaded.
- 2Read the decoded header and payload as JSON.
- 3Check the issued-at and expiry times to see if it is still valid.
What is a JWT?
A JSON Web Token (JWT) is a compact, signed token used for authentication and authorization. It has three Base64url parts separated by dots — header, payload, and signature — that together carry claims like who the user is and when the token expires.
How decoding works here
Paste a token and it is split and Base64url-decoded in your browser to reveal the header and payload as readable JSON, including issued-at and expiry times. The token never leaves your device, so it is safe to inspect real tokens.
When to use a JWT decoder
Debug why a login or API call is rejected, check what claims and roles a token carries, confirm whether a token has expired, or inspect the algorithm in the header while building an auth flow.
Decoding is not verifying
This tool decodes a JWT so you can read it; it does not verify the signature. Anyone can read a JWT's payload, so never put secrets in it. Only the server holding the signing key can confirm a token is genuine and untampered.
FAQ
Is my token uploaded?+
No. The JWT is decoded in your browser, so it never leaves your device — safe for real tokens.
Does this verify the signature?+
No. It decodes the token so you can read it, but it does not verify the signature. Only the server with the signing key can confirm a token is genuine.
Can I see when a token expires?+
Yes. The decoded payload shows the issued-at and expiry times so you can tell if a token is still valid.
Is it safe to put secrets in a JWT?+
No. Anyone can decode a JWT's payload, so never store secrets in it.
Is it free?+
Yes, completely free — no sign-up and no watermark.