← All tools
// Security

JWT Decoder online

Decode JWT tokens - header, payload and expiry - no data leaves your browser

JWT Decoder logo
by
CHUNKY
MUNSTER
// Paste your JWT token

How to Use the JWT Debugger

  1. Paste a JWT (three dot-separated base64url segments) into the input.
  2. Click Decode - the header and payload appear as pretty JSON.
  3. If exp / iat claims are present they are formatted as local timestamps.
  4. The signature is shown raw because verification needs the issuer's key.

JWT Decoder splits the token on its two dots, base64url-decodes the first two segments and parses each as JSON. This JWT parser handles padding restoration before calling atob() so URL-safe tokens with stripped = signs work without errors. The header and payload are pretty-printed; exp and iat claims (Unix seconds) are formatted as local timestamps so you can see at a glance whether the token is still valid. Use this JWT inspector to quickly verify the claims of any bearer token without risk.

How the JWT Inspector Works

Crucially this is a decoder, not a verifier - the signature segment is shown as raw base64url because checking it requires the issuer's HMAC secret or public key, which the browser does not have. This JWT debugger is safe for untrusted tokens (no code runs), but never paste a production token from a system you do not trust into any third-party site. Everything in this page runs locally, making it a secure way to decode JWT online.

Frequently Asked Questions

Does this verify the JWT signature?

No. Verification needs the issuer's secret (HS*) or public key (RS*/ES*/PS*). Decoding only reveals what the token claims; trust still requires checking the signature on your server with the right key and algorithm.

What encoding is used inside a JWT?

Base64url (RFC 4648 §5) without padding - the URL-safe variant where + becomes -, / becomes _, and trailing = signs are stripped. The decoder restores padding before calling atob() to handle that.

Why is my token reported as expired?

If the payload contains an exp claim (Unix seconds), the decoder compares it to the current device time. A token can also appear expired if your system clock is wrong - JWTs use UTC seconds, so timezone is not the issue.

Are the contents of a JWT secret?

No. The header and payload are only base64url-encoded, not encrypted - anyone with the token can read them. Never put passwords or PII into a JWT payload; that is what JWE (encrypted JWTs) is for.

Whether you are checking scopes, expiration dates, or issuer claims, this technical utility provides instant visibility into your tokens. Bookmark this JWT Decoder for a fast, reliable, and secure way to inspect any JSON Web Token.

This JWT Decoder follows 📖 Reference: RFC 7519 - JSON Web Token (JWT)

// deep diveRead the guide →