Paste a JWT token above to decode its header and payload
Decode and inspect JSON Web Tokens online, free. A JSON Web Token (JWT, RFC 7519) is a compact, URL-safe credential made of three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. This decoder splits the token and decodes the header and payload so you can read the signing algorithm, the claims, and human-readable timestamps — entirely in your browser, so the token never leaves your device.
Decoding happens 100% client-side — your token is never uploaded, logged, or stored, which matters because a JWT often grants real access. 100% free, no registration, and complete privacy — everything runs locally in your browser, so your data never touches a server.
Splits the token on its dots and Base64URL-decodes the header and payload, showing the algorithm (alg), type, and every claim.
Standard time claims like exp, iat and nbf are shown as human-readable dates so you can immediately see when a token was issued or expires.
Recognizes registered claims (iss, sub, aud, exp, iat, nbf, jti) so the payload is easy to scan.
Decoding runs locally in your browser — your JWT is never sent to a server, so it's safe to inspect production tokens.
A JSON Web Token (RFC 7519) is a string with three Base64URL parts — header.payload.signature. The header names the algorithm, the payload carries claims (like user id, scopes and expiry), and the signature lets the issuer prove the token wasn't tampered with.
This is a decoder: it reveals the header and payload so you can read the claims, but decoding alone does not prove the signature is valid. To trust a token in production you must verify its signature against the issuer's key on your server.
Yes. Decoding happens entirely in your browser and the token is never uploaded, logged, or stored. Still, treat live tokens as secrets and avoid pasting them into tools whose privacy you can't confirm.
Yes. A standard JWT is signed, not encrypted — the payload is only Base64URL-encoded, so anyone with the token can decode and read it. Never put secrets or sensitive personal data in a JWT payload.
They are time claims, expressed as Unix timestamps: iat = issued-at, exp = expiry (the token is invalid after this), and nbf = not-before (invalid until this time). This decoder shows them as readable dates.
The current time is past the exp claim. Tokens are short-lived by design; obtain a fresh one from your auth server or use a refresh token. Check the decoded exp date here to confirm.
We use cookies for analytics and personalized ads to help keep these tools free. Until you accept, ads stay non-personalized and analytics cookies are off. See our Privacy Policy.