Free JWT Decoder
Paste any JSON Web Token to inspect its header and payload — instantly, privately.
Header
Payload
Signature
Security note: this tool decodes the token — it does not verify the signature. Never trust a token's claims without server-side verification.
How to use the JWT decoder
- Paste a JWT into the box (or load the sample).
- Press Decode.
- Inspect the header, payload claims, and expiry.
Reading a JWT like a pro
A JWT has three Base64URL-encoded parts separated by dots: header, payload, signature. The payload's most useful claims are iss (who issued it), sub (who it's for), exp (expiry as a Unix timestamp), and iat (issued-at). This decoder flags expired tokens automatically — the number-one cause of mysterious 401 errors. Remember the critical security rule: decoding is not verifying. Anyone can decode a JWT; only the server holding the secret (or public key) can verify the signature proves it wasn't tampered with. Never put sensitive data like passwords in a payload, and treat tokens like passwords: don't paste production tokens into random websites — though this one runs entirely in your browser, so nothing leaves your machine.
Frequently asked questions
Does this verify the JWT signature?
No. Decoding only reveals the contents. Signature verification requires the issuer's secret or public key and must happen server-side.
Why does my API return 401 with a valid-looking token?
Usually an expired exp claim or a wrong audience/issuer. Decode it and check the timestamps first.
Is it safe to paste my token here?
Decoding happens entirely in your browser — the token is never transmitted. Still, prefer test tokens over production secrets out of habit.
What is Base64URL?
A URL-safe variant of Base64 used by JWTs: + becomes -, / becomes _, and padding = is dropped.