JWT Decoder

Inspect JWT headers and payloads, with expiry checks. Decode JSON Web Tokens and inspect header and payload as formatted JSON. Automatic expiry and issued-at checks. Free online JWT debugger.

This interactive tool needs JavaScript enabled. All calculations run locally in your browser — nothing is ever uploaded.

This tool runs 100% in your browser. Your input is never sent to any server — you can even go offline after the page loads.

About the JWT Decoder

A JWT carries three Base64URL blocks — header, payload and signature — and debugging an API usually starts with "what is actually in this token?". Paste one here to see the algorithm in its header, every claim in its payload as formatted JSON, and human-readable timestamps for issued-at, not-before and expiry, including a live verdict on whether the token has expired. Signatures are not verified (that requires the secret), but the structure and claims are fully decoded.

How to use the JWT Decoder

Paste the full JWT (all three dot-separated parts).
Review the decoded header for the signing algorithm.
Inspect the payload claims and timestamps.
Check the expiry verdict before blaming your API.

Key features

Decodes header and payload to formatted JSON
Human-readable exp, nbf and iat timestamps
Live expired / valid indicator
Offline — tokens never leave your browser

Does decoding a JWT require the secret key?

No. The header and payload are only Base64URL-encoded, not encrypted, so anyone can read them. Verifying the signature — proving the token was not tampered with — does require the secret or public key.

Is it safe to paste a JWT here?

The decoding happens entirely in your browser and nothing is transmitted. Even so, treat tokens like passwords and avoid sharing them publicly.

Related Developer Tools tools

More utilities from the same category.

View all →

JSON Formatter

Beautify, validate and minify JSON with precise error locations.

Base64 Encoder / Decoder

Encode or decode Base64 safely, including emoji and non-Latin text.

URL Encoder / Decoder

Percent-encode or decode URLs and query-string values.

HTML Entity Converter

Escape or unescape HTML entities — keep code visible and safe.

Hash Generator

Create MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes instantly.

UUID Generator

Bulk-generate random UUID v4 identifiers with one click.