JWT Decoder
Decode and inspect JSON Web Tokens — header, payload, and expiry. Tokens are never sent to a server — everything runs in your browser.
⚠️ Note: This tool decodes but does NOT verify signatures. Never paste production tokens in any online tool unless you trust the environment.
0 chars
About JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. Every JWT has three Base64URL-encoded parts separated by dots: the header (algorithm and type), the payload (the claims — user ID, role, expiry, etc.), and the signature (cryptographic proof). JWTs are used everywhere: OAuth 2.0, OpenID Connect, Auth0, Firebase Auth, Supabase, and custom auth systems. This decoder splits the token, Base64URL-decodes each part, and shows you the readable JSON. It also highlights common claims like exp (expiration), iat (issued at), and nbf (not before), and warns you if the token is expired. Everything runs in your browser — your tokens never leave your device.
How It Works
- Paste a JWT (starts with "eyJ...") into the input box.
- The decoder instantly splits the token into its three parts (header, payload, signature).
- Header and payload are Base64URL-decoded and shown as formatted JSON.
- The signature is displayed in its raw encoded form (verification requires the secret/key, which you should never share).
- Common claims like exp, iat, nbf, iss, sub, aud are highlighted with human-readable dates.
✨ Key Features
- ✓Decode JWT header and payload instantly
- ✓Base64URL decoding (RFC 4648 §5)
- ✓Human-readable timestamps for exp, iat, nbf
- ✓Expiry status indicator (valid / expired)
- ✓Signature shown in encoded form
- ✓Supports all standard JWT algorithms (HS256, RS256, ES256, etc.)
- ✓Pretty-printed JSON output
- ✓Works with copy-pasted tokens from any source
- ✓100% client-side — tokens never sent to a server
🎯 Common Use Cases
- →Debugging authentication issues with Auth0, Firebase, Supabase, Clerk
- →Inspecting OAuth 2.0 access tokens and ID tokens
- →Checking whether a JWT has expired without logging in
- →Understanding custom claims in a token
- →Teaching or learning about JWT structure
- →Verifying token contents during API development
- →Troubleshooting "invalid token" or "unauthorized" errors
- →Auditing what information is exposed in a token
💡 Advanced Tips & Pro Insights
- ▸A JWT is NOT encrypted — anyone can decode it. Never put secrets (passwords, API keys, PII) inside a JWT payload unless it is a JWE (encrypted JWT).
- ▸The exp, iat, and nbf claims are Unix timestamps in SECONDS (not milliseconds).
- ▸This tool only DECODES — it does not VERIFY signatures. Verification requires the secret (HS256) or public key (RS256/ES256) and is a server-side operation.
- ▸Base64URL differs from standard Base64: it uses - and _ instead of + and /, and omits padding =. JWTs follow Base64URL.
- ▸Token IDs (jti claim) are used for revocation. If a JWT is stolen, it remains valid until exp unless the server maintains a revocation list.
Frequently Asked Questions
Is this JWT decoder free?▾
Yes, this JWT decoder is completely free with no signup, registration, or usage limits.
Is my token safe?▾
Yes, 100% safe. All decoding happens in your browser using JavaScript. Your token is never sent to any server. For maximum security, we recommend not decoding production tokens on any online tool — including this one — unless you trust the environment.
What is a JWT?▾
A JWT (JSON Web Token, RFC 7519) is a compact, URL-safe token with three parts separated by dots: header.payload.signature. It is widely used in OAuth 2.0, OpenID Connect, and modern authentication systems to securely transmit claims between parties.
Does this tool verify the token signature?▾
No. Verifying a JWT signature requires the secret (for HMAC) or public key (for RSA/ECDSA), which should never be shared with a client-side tool. This decoder only reads the header and payload, which are public by design.
Is a JWT encrypted?▾
No. A standard JWT (JWS) is only signed, not encrypted. Anyone can Base64URL-decode the header and payload — you should never include sensitive data like passwords or secrets. Encrypted JWTs (JWE) exist but are less common.
Why is my token "expired"?▾
The exp claim in the payload is a Unix timestamp indicating when the token expires. If the current time is past exp, the token is expired and most servers will reject it. You need to refresh the token or log in again.
What do the exp, iat, and nbf claims mean?▾
exp = expiration time (when the token becomes invalid), iat = issued at (when the token was created), nbf = not before (when the token becomes valid). All are Unix timestamps in seconds.
What algorithms do JWTs use?▾
Common JWT algorithms are HS256/HS384/HS512 (HMAC with SHA), RS256/RS384/RS512 (RSA), ES256/ES384/ES512 (ECDSA), and PS256/PS384/PS512 (RSA-PSS). The algorithm is declared in the header's "alg" field.