JWT
Decode and inspect JWT tokens instantly. See header, payload, and signature in a readable format. Free, no sign-up — token never leaves your browser.
A free online JWT decoder and viewer that splits a JSON Web Token into its three parts — header, payload, and signature — and shows the decoded header and payload as readable JSON. Use it to inspect the claims inside a bearer token while debugging an API, to confirm which signing algorithm and key id a token declares, or to check when a token expires. Decoding happens entirely in your browser, so the token is never transmitted to a server — an important difference from services that decode server-side. Note that this tool reads a token for inspection; it does not verify the signature, which would require the signing secret or public key.
Common uses
- Inspect the claims (sub, exp, iat) inside a bearer token while debugging an API.
- Confirm which algorithm (alg) and key id (kid) a token declares in its header.
- Check a token’s expiry without pasting it into an online service you do not control.
- Read the payload of a token returned by an auth provider to see the issued scopes.
- Compare two tokens to spot which claim changed between requests.
Frequently asked questions
Does this verify the JWT signature?
No. This tool decodes the header and payload for inspection; it does not verify the signature, which requires the signing secret or public key.
Is it safe to paste a real token here?
Decoding runs entirely in your browser and the token is never transmitted. Still, treat production tokens with care and avoid sharing the decoded output.
What are the three parts of a JWT?
A JWT has a header (algorithm and token type), a payload (the claims), and a signature — joined by dots. This tool base64url-decodes the header and payload and displays them as JSON.
Why is the signature shown but not decoded?
The signature is a cryptographic value, not encoded data, so it has no human-readable form. It is used to verify the token, which requires the signing key.
Can I tell if a token is expired?
Yes. The decoded payload shows the exp (expiry) and iat (issued-at) claims as timestamps, so you can see whether the token is still valid.
All processing is local — your data never leaves your browser.