JWT Decoder — Decode JSON Web Tokens Online
Paste a JWT to decode its header and payload instantly in your browser.
🔒 Your file never leaves your browser. Tokens are decoded locally using JavaScript.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Signature (base64url, not verified)
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
How to Decode a JWT Token Online
- 1
Paste your JWT
Paste a JSON Web Token into the input field. The token consists of three base64url-encoded parts separated by dots.
- 2
View decoded header and payload
The header and payload are decoded instantly and displayed as formatted JSON below.
- 3
Check expiry and claims
The tool highlights the expiry status and key claims like 'sub' (subject), 'iss' (issuer), and 'iat' (issued at).
A JWT looks like an opaque blob, but it is really three base64url-encoded JSON documents joined by dots: a header describing the signing algorithm, a payload carrying the claims, and a signature. Base64url is encoding, not encryption — anyone holding a token can read its contents, and this decoder simply does that reading for you with the claims laid out and timestamps translated into human dates.
Why decode a token at all? Debugging auth is the classic case: a request is rejected and you need to know whether the token expired (exp), was issued for the wrong audience (aud), is missing a role or scope claim, or was signed with an unexpected algorithm. Ten seconds in a decoder answers what an hour of log-reading might not.
Decoding is not verification: this tool tells you what a token says, never whether it is genuine. Signature verification requires the signing secret or public key and belongs on your server — any token can be forged to say anything, so never trust decoded claims from an unverified token.
A privacy note specific to JWTs: real tokens from production systems grant access to real accounts. Pasting them into an online tool that ships them to a server is a genuine security risk — which is why this decoder runs entirely in your browser with no network traffic. For inspecting the timestamps inside claims, the Unix timestamp converter handles the raw epoch values.