JSON Web Tokens carry authentication and authorisation data between systems, but to human eyes they are three blocks of unreadable encoded text. Our free JWT decoder unpacks a token’s header and payload into clean, formatted JSON so you can inspect the claims inside: who issued it, who it belongs to, and exactly when it expires, with the exp timestamp also converted into a real date. Everything happens in your browser: your tokens are never uploaded, which matters because a live token is a credential.
Quick Answer: Paste a JWT and the decoder shows its header and payload as readable JSON, converts iat and exp timestamps into real dates, and warns you if the token has already expired.
Free Online Tool
JWT Decoder
Inspect a token’s header and claims. Decoding happens locally — tokens never leave your browser.
Header
Payload
How to Use the JWT Decoder
- Copy the complete token, including both dots that separate its three parts.
- Paste it into the box; decoding happens immediately.
- Read the header first to see the signing algorithm and token type.
- Review the payload claims: subject, issuer, audience and the custom data your app stored.
- Check the expiry line: the tool converts exp into a human date and flags expired tokens in red.
Key Features
- Decodes header and payload into neatly formatted JSON.
- Converts standard time claims (exp, iat, nbf) into readable UTC dates automatically.
- Live expiry status: valid, expired, or not yet valid, calculated against your clock.
- Validates the token's three-part structure and Base64URL encoding with clear errors.
- 100 percent local decoding: tokens never leave your browser, an important safety property.
Best Practices and Tips
- Treat any real token like a password: never paste production tokens into websites you do not trust, and never share decoded screenshots that include session tokens.
- This tool decodes but does not verify the signature; a decoded token proves what it claims, not that the claims are trustworthy.
- When debugging 'token expired' errors, compare the exp date here with your server's clock; clock skew between machines is a frequent hidden cause.
- Check the aud and iss claims when an API rejects a token you expected to work; mismatched audience is a classic integration bug.
Common Mistakes to Avoid
- Assuming a decoded token is verified: anyone can craft a token with any payload; only the signature, checked with the correct key, proves authenticity.
- Pasting a token with a trailing space or missing characters copied from a narrow terminal; the decoder will report invalid encoding, so re-copy carefully.
- Storing tokens in browser localStorage for sensitive apps without understanding XSS risk; decoding tools cannot fix an insecure storage choice.
Frequently Asked Questions
What are the three parts of a JWT?
A header describing the signing algorithm, a payload containing the claims (data statements such as user ID and expiry), and a signature. The first two parts are Base64URL-encoded JSON, which is what this tool reveals; the signature is the cryptographic proof and is not decoded into JSON.
Can this tool verify that a token is genuine?
No. Verification requires the secret key or public key used to sign the token, which must stay on your server. This decoder is for inspection and debugging; your backend must always verify signatures before trusting claims.
Is it safe to paste my token here?
The decoding runs entirely in your browser with JavaScript; the token is never transmitted or stored. That said, good practice is to revoke or rotate any real credential you have pasted anywhere outside your own systems.
What does the exp claim mean?
exp is the expiry time as a Unix timestamp: the moment after which the token must be rejected. This tool converts it into a normal date and tells you how long remains or how long ago it expired.
Why does my token fail to decode?
Common causes are a missing part (a JWT must have exactly three sections separated by dots), characters outside the Base64URL alphabet, or copying an encrypted JWE token, which is a different format that cannot be read this way.
Related Tools
- Base64 Encoder / Decoder – encode text to Base64 or decode Base64 strings back to text
- Unix Timestamp Converter – convert epoch timestamps to dates and dates back to timestamps
- JSON Formatter & Validator – beautify, validate and minify JSON with precise error locations
- UUID Generator – create random version 4 UUIDs singly or in bulk batches