JWT Decoder

Inspect a JWT's header, claims and expiry, decoded locally, never sent anywhere.

A JWT often is a live credential. Pasting one into an online decoder that sends it to a server hands over whatever access it grants. This tool decodes in your browser and makes no network requests, you can confirm that in the Network tab. Even so, treat production tokens with care and revoke anything you have pasted somewhere you did not fully trust.

Paste a token to decode it.

HeaderAlgorithm and type
,
PayloadThe claims
,
Registered claims
, Token status
, Algorithm
, Expires

Features

  • Decodes header and payload with formatting
  • Registered claim reference with human-readable times
  • Expiry status and countdown
  • Handles Base64URL padding correctly
  • Nothing is transmitted, decoding is local

How to use it

  1. Paste your token into the box.
  2. The header and payload decode immediately.
  3. Check the claims table for expiry and issuer.
  4. Clear the box when you are finished.

What decoding a JWT does and does not prove

A JWT has three Base64URL-encoded parts separated by dots: header, payload and signature. The first two are merely encoded, not encrypted, anyone holding the token can read every claim in it. That is by design, and it is why you must never put anything confidential in a JWT payload. Assume the user, and anyone who intercepts the token, can read it.

This tool decodes but does not verify. Verification means recomputing the signature over the header and payload using the secret or public key, and that requires the key, which you should not paste into a website. An unverified token proves nothing: an attacker can change any claim and re-encode it. Always verify server-side before trusting a single field.

The classic vulnerability is the alg header. Early libraries would read the algorithm from the token itself, so an attacker could set alg to none, strip the signature, and have the token accepted. A related attack switches RS256 to HS256 so the public key gets used as an HMAC secret. Modern libraries reject both, but the lesson stands: the server must decide which algorithm is acceptable, never the token. This decoder flags alg: none prominently for that reason.

Frequently asked questions

Yes, completely. JWT Decoder is free with no usage limits, no account and no sign-up. There is no paid tier and no trial that expires. Tools marked Premium on this site carry that label to indicate a deeper feature set, not a price.
JWT Decoder covers decodes header and payload with formatting, registered claim reference with human-readable times, expiry status and countdown, among other things. Everything is available immediately with no account, no sign-up and no usage limit.
A JWT has three Base64URL-encoded parts separated by dots: header, payload and signature. The first two are merely encoded, not encrypted, anyone holding the token can read every claim in it. That is by design, and it is why you must never put anything confidential in a JWT payload. Assume the user, and anyone who intercepts the token, can read it.
Everything is processed in your browser. Code, tokens and payloads you paste in never leave your device, which matters when you are debugging something that contains real credentials or customer data. Check the Network tab if you want to confirm it. Because nothing depends on a server, the tool also keeps working offline once the page has loaded, the site registers a service worker that caches it after your first visit.

Related tools

Further reading

📖 How to Decode a JWT (and Why You Should Never Paste One Online)

Read the full guide on the 123MiniApps blog.

Pick a theme

Ten hand-tuned palettes.