JWT Decoder
Decode and inspect JSON Web Tokens. Free, no signup.
How It Works
Paste a JWT token and click Decode. The header and payload are Base64-decoded and displayed as formatted JSON. The signature is shown but not verified (that requires the secret key). No data is ever sent to a server.
What Is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and information exchange. It consists of three Base64-encoded parts separated by dots: header (algorithm and type), payload (claims and data), and signature (verification). JWTs are widely used in OAuth, APIs, and single sign-on systems.
Common JWT Payload Claims
The payload carries "claims" — standard fields with reserved names. Here are the ones you will see most often when you decode a token:
| Claim | Meaning |
|---|---|
| iss | Issuer — who created the token |
| sub | Subject — the user or entity the token is about |
| aud | Audience — who the token is intended for |
| exp | Expiration time (Unix timestamp) |
| iat | Issued-at time (Unix timestamp) |
| nbf | Not-before time — valid only after this |
Click any decoded section above to copy its contents to your clipboard.
Frequently Asked Questions
How do I decode a JWT online?
Paste the token into the box and click Decode. The tool splits the JWT on its dots, Base64-decodes the header and payload, and shows each as formatted JSON. The signature is displayed as-is, and if the payload has an exp claim you also see whether the token is still valid or expired.
Does this tool verify the JWT signature?
No. It decodes and displays the header, payload, and signature so you can read the claims, but it does not verify the signature because that requires the secret or public key. Treat a decoded payload as readable, not as proof the token is authentic or untampered.
Is it safe to paste a JWT here?
The decoding happens entirely in your browser with JavaScript, and your token is never sent to a server. That said, a JWT is a credential, so avoid pasting production tokens into any online tool you do not trust, and be aware that anyone with the token can read its payload.
Can I tell if a JWT is expired?
Yes. If the payload contains an exp (expiration) claim, the tool converts that Unix timestamp to a readable date and shows whether the token has expired or is still valid. Tokens without an exp claim show no expiry status.
Why is the JWT payload readable without a password?
A JWT payload is only Base64URL-encoded, not encrypted. Encoding is reversible by anyone, so the claims inside are effectively public. The signature protects against tampering, not against reading, so never store secrets or sensitive data in a JWT payload.