Image tools

JWT Decoder

Read the header and payload of a JSON Web Token, with expiry checked against your clock.

Runs in your browser. Nothing you type is sent to a server.

How to use JWT Decoder — Decode JSON Web Tokens Online Free

  1. 1Paste your JSON Web Token — the Bearer prefix is stripped automatically.
  2. 2The header and payload are decoded instantly, with standard claims shown as readable dates.
  3. 3Check the expiry banner to see whether the token is still valid.

About JWT Decoder

A JSON Web Token is three Base64url segments joined by dots: a header saying how it was signed, a payload of claims, and a signature over the first two. This decoder splits it and pretty-prints the JSON so you can see what a token actually asserts.

The single most misunderstood thing about JWTs is that they are not encrypted. Signing proves a token has not been altered; it does nothing to hide the contents. Anyone who holds the token can read every claim inside it, which is why user emails, roles and internal identifiers in a payload should be treated as public.

Signature verification is intentionally absent. It cannot be done without the key, and a tool that invites people to paste signing secrets into a browser is teaching a genuinely dangerous habit. The expiry check, which needs no key at all, is the part that actually helps while debugging.

Frequently asked questions

Does this verify the signature?
No, deliberately. Verifying needs the signing secret or public key, and pasting a production signing secret into a web page is a habit worth never starting. The signature is displayed but not checked.
Is a JWT encrypted?
No. The header and payload are only Base64url-encoded, which means anyone holding the token can read every claim in it. Never put anything confidential in a JWT payload.
Why does my token show as expired?
The exp claim is compared against your device's clock. If the token should still be valid, check that your system time is correct — clock skew is a common cause of confusing auth failures.
What do iss, sub, aud and iat mean?
Issuer (who created the token), subject (who it is about), audience (who it is for), and issued-at (when it was created). They are the registered standard claims and are shown as a readable table.
Is my token sent anywhere?
No. Decoding happens entirely in your browser. Even so, treat any token you paste anywhere as compromised and rotate it if it is still live.
Is it free?
Yes — unlimited use, no sign-up, no watermark and no limit on how many times you run it.