JWT Token Decoder & Debugger
Decode a JSON Web Token to read its header and payload. The token is split on its dots and the Base64URL segments are decoded in your browser, so you can see the claims — subject, issuer, expiry — while debugging an authentication problem.
{
"alg": "HS256",
"typ": "JWT"
}{
"name": "Alex Jerome",
"role": "Admin",
"iat": 1516239022,
"exp": 1800000000
}How it works
- 1
Paste the token. A JWT has three dot-separated parts: header, payload and signature.
- 2
The header and payload are Base64URL-decoded and shown as formatted JSON.
- 3
Read the claims — check exp for expiry, iss for issuer, aud for audience.
- 4
Copy anything you need for a bug report, remembering that the token itself is a credential.
What people use it for
- Checking whether a token has expired while debugging a 401 response.
- Confirming that the roles or scopes claim contains what your API expects.
- Reading the issuer and audience while configuring an identity provider.
- Learning how JWTs are structured while implementing authentication.
Supported formats & options
| Input | A three-part JWT: header.payload.signature |
|---|---|
| Decoded | Header and payload, shown as formatted JSON |
| Encoding | Base64URL segments, as defined by the JWT specification |
Key advantages & benefits
Immediate claim visibility
Read exp, iat, sub and any custom claims without writing a decoding snippet.
Formatted output
The payload is shown as indented JSON rather than a wall of Base64.
Faster auth debugging
Most token problems are an expired exp, a wrong aud or a missing claim — all visible immediately.
The token never leaves your device
A JWT is a live credential. Decoding it locally means it is not sent to a third-party service that logs it.
Limits & things to know
- The signature is not verified. This tool shows what a token says, not whether it is authentic — verification requires the signing key and must happen on your server.
- Encrypted tokens (JWE) are not readable. Only signed tokens (JWS), where the payload is merely encoded, can be decoded.
- A decoded payload proves nothing about validity. Never make an authorisation decision from a token whose signature has not been checked.
- Timestamps are Unix seconds; convert them if you need a readable date.
Troubleshooting
The token will not decode
Check that it has exactly three dot-separated parts and no whitespace or line breaks introduced when it was copied from a log or a header.
The payload looks like random characters
It is probably an encrypted JWE rather than a signed JWT. Those cannot be read without the decryption key.
The API rejects a token that looks correct here
Decoding only proves the structure. Check the signature, the issuer and audience claims, and clock skew between the issuing and verifying servers.
Privacy & data handling
Decoding happens entirely in your browser — the token is never sent to our server. This matters more than usual here: a JWT is a bearer credential, and pasting one into a service that logs it is equivalent to handing over the account until the token expires.
JWT Decoder — Decode JSON Web Tokens Online Safely
Paste a JSON Web Token and read its header, payload and claims in formatted JSON. A free online JWT decoder that runs entirely in your browser — the only responsible place to inspect a token, because a JWT is a bearer credential.
- Header and payload decoded instantly — the Base64url segments are decoded and pretty-printed so you can read the algorithm, claims and custom fields at a glance.
- Expiry and timestamp claims in plain English — exp, iat and nbf are shown as readable dates, which is usually the fastest way to explain why an API call is returning 401.
- Debug authentication flows — confirm the issuer, audience, scopes and role claims your identity provider is actually issuing, rather than what you assume.
- Never transmitted — decoding happens locally in the tab — pasting a live access token into a server-side decoder would hand over a working credential.
- Decoding is not verification — anyone can read a JWT payload; only your backend holding the signing key can prove it is authentic, so never trust claims client-side.
Free with no account. Format the decoded payload further with the JSON Formatter, or decode raw segments with the Base64 Converter.
Frequently asked questions
Is it safe to paste private JWT tokens?
Yes! Decoding is done strictly inside your browser memory using JavaScript — no network requests are sent.
Does this verify the token's signature?
No, and that distinction matters. It shows what the token claims; proving those claims are authentic requires the signing key and must happen on your server. Never make an authorisation decision from a decoded payload alone.
Is it safe to paste a real token here?
Decoding happens entirely in your browser, so the token is not transmitted to us. Still treat any JWT as a live credential: it grants access until it expires, so avoid pasting production tokens into tools generally, and rotate one that has been shared.
How do I read the expiry time?
The exp claim is a Unix timestamp in seconds. Convert it to a date to check whether the token has expired — an expired token is the single most common cause of an unexpected 401.
Related tools
JSON Formatter
Format, validate and minify JSON instantly
Base64 Encoder & Decoder
Encode text or images to Base64 and decode back
Strong Password Generator
Generate secure, random, hack-proof passwords
Image Compressor & Optimizer
Compress JPG, PNG & WebP images without losing quality