Free online JWT decoder
Inspect JSON Web Token headers and payloads - including algorithm and expiry hints - privately in your browser. Paste a token, decode it locally for debugging auth flows, and remember: decode is not verify.
What you can do
Decode header
See algorithm (alg), token type, and other header fields as readable JSON - useful when debugging auth middleware.
Inspect payload
View claims like sub, roles, iat, and exp in a tree or as formatted JSON you can copy for tickets and logs.
Expiry hints
When exp or iat are present as Unix seconds, we surface ISO timestamps so you can spot expired tokens quickly.
Header, payload, and signature
- Header
- Metadata about the token, usually including alg (signing algorithm) and typ (often JWT). Treat alg as a hint only - your server decides which algorithms to accept.
- Payload
- Claims about the subject: identity, roles, scopes, and time fields. Anyone who has the token can read this section after Base64URL decoding.
- Signature
- Proves the header and payload were not altered - but only when verified with the correct secret or public key. This tool does not verify signatures.
A JWT is three Base64URL segments separated by dots: header.payload.signature.
Decode only - not verification
Anyone can craft a token with arbitrary claims. A decoder shows what is inside; it does not prove the token was signed by your auth server. Always verify signatures (and check exp) on a trusted backend before granting access. Read decode vs verify.
Common claims and expiry
exp (expiry)
Unix seconds after which the token should be rejected. Auth failures often mean the clock passed exp - or the client and server disagree on time.
iat (issued at)
When the token was created. Helpful for debugging refresh logic and token age.
sub, aud, iss
Subject, audience, and issuer - standard registered claims. Custom claims (roles, tenant ids) usually live alongside them in the payload.
How to use this JWT decoder
- Paste a full JWT into the input panel, or click Sample for a demo token.
- Click the arrow between the panels to decode header and payload.
- Review algorithm and expiry hints, then explore the JSON trees.
- Copy the payload JSON when you need it in a ticket, test, or log note.
- Use Clear when you are done - decoding never leaves your browser.
Frequently asked questions
Learn more about JWTs
Related tools: JSON formatter, Base64 encoder, SHA-256 generator.
Why decode JWTs locally?
During development you often need to see claims, roles, and expiry without hitting an auth server. A local decoder speeds that up while keeping tokens on your machine - useful when payloads include emails, tenant ids, or internal scopes you should not paste into a third-party upload service.