Decode and inspect JSON Web Tokens (no data sent to server)
The JWT Decoder splits a JSON Web Token into its three dot-separated sections — header, payload, and signature — and Base64Url-decodes the first two into readable JSON so you can inspect exactly what a token carries. It surfaces the header's alg and typ fields, every claim in the payload, and automatically converts NumericDate claims like exp, iat, and nbf into human-readable dates so you can see at a glance whether a token has expired.
It is built for backend and frontend developers, QA engineers, and API integrators who need to debug authentication flows, confirm which claims an identity provider issued, or check token expiry without pasting sensitive credentials into a remote server. Everything runs locally in your browser.
A JWT is three Base64Url-encoded strings joined by dots: header.payload.signature. The decoder takes each of the first two segments, converts Base64Url back to standard Base64 (replacing - with + and _ with /, and re-adding any stripped = padding), then decodes the bytes to a UTF-8 JSON string. The header typically looks like {"alg":"HS256","typ":"JWT"} and the payload holds claims such as sub, iss, aud, exp, and iat.
Time-based claims use NumericDate — the number of seconds since the Unix epoch (1970-01-01 UTC). The tool multiplies these by 1000 to build a JavaScript Date, so exp of 1893456000 becomes a calendar date you can read, and a token is treated as expired when exp is earlier than the current time. Decoding is not the same as verification: this tool reads the token but does not check the signature, because verifying HS256 or RS256 requires the secret or public key. Never trust a decoded payload as authenticated without validating the signature server-side.
No. It decodes and displays the header and payload but does not validate the signature. Signature verification needs the signing secret (for HS256) or the issuer's public key (for RS256/ES256) and should be done on your server.
It is completely free, and decoding happens entirely in your browser using JavaScript. Your token is never sent to our servers, which makes it safe for inspecting tokens during development.
The exp claim holds a Unix timestamp in seconds. The tool compares it against the current time, and if that moment has already passed, the token is flagged as expired. Check the iat and nbf claims too if the token is not yet valid.
alg is the algorithm used to sign the token, such as HS256 (HMAC-SHA256) or RS256 (RSA-SHA256), and typ is the token type, almost always JWT. These tell your server which key and method to use for verification.
An expired token still decodes fine, since expiry only affects validity, not readability. A malformed token that is missing a section or contains invalid Base64Url characters cannot be decoded and will produce an error.
JWTs use Base64Url encoding, not encryption. It is reversible by design, so anyone can read the claims. This is why you must never put passwords or secrets in a JWT payload.
A JWT is a structured token made of three Base64Url-encoded JSON segments plus a signature, whereas plain Base64 is just an encoding of arbitrary bytes. The JWT decoder understands the three-part structure and the claim semantics.