JWT Decoder
Decode a JWT to inspect its header and payload, formatted as readable JSON. Decoding happens locally — your token is never sent anywhere. Free and in-browser.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Toolko User",
"iat": 1516239022,
"exp": 1793593600
}How to use the JWT Decoder
- 1Copy your JWT from wherever it lives — an Authorization: Bearer header, a cookie, localStorage, or an API response — and paste the full three-part string into the input box.
- 2The tool automatically splits the token on its dots and Base64URL-decodes the header and payload as you paste, so no separate 'decode' click is usually needed.
- 3Read the decoded header panel to see the algorithm (alg) and type (typ), and the payload panel to inspect claims like sub, iss, exp, iat, and any custom fields.
- 4Check the exp and iat timestamps to determine whether the token is still valid, converting the Unix seconds to a readable date if the tool offers that toggle.
- 5Use the copy button to grab the formatted JSON output for a bug report, or clear the field to decode another token — nothing you paste ever leaves your browser.
About the JWT Decoder
A JSON Web Token looks like three chunks of gibberish separated by dots, but each chunk is just Base64URL-encoded data. This JWT Decoder splits your token on those dots and decodes the first two segments — the header and the payload — turning them into clean, indented JSON you can actually read. The header typically reveals the signing algorithm (like HS256 or RS256) and token type, while the payload exposes the claims: who the token is for (sub), who issued it (iss), when it expires (exp), when it was issued (iat), and any custom claims your application packed in, such as roles, scopes, or tenant IDs. Everything happens inside your browser using native JavaScript. Your token is never uploaded, logged, or transmitted anywhere — the decoding runs entirely client-side, which matters enormously because JWTs frequently carry live session credentials you should never paste into a remote server. Developers reach for this constantly: debugging why an API call returns 401, checking whether a token has already expired, confirming that a login flow stamped the right roles into the payload, or inspecting a token captured from browser dev tools or an Authorization header. QA engineers use it to verify claim contents against a spec; support teams use it to diagnose why a user got locked out. A practical tip: this tool decodes but does not verify the cryptographic signature, so a decoded token that looks valid could still be forged — never trust decoded claims for authorization decisions without verifying the signature server-side against the issuer's key. Another tip: convert the exp and iat values (they are Unix timestamps in seconds) to human dates to spot expiry problems instantly. Because JWTs are only encoded and not encrypted, anyone holding the token can read its payload — so this tool simply shows you what's already visible, and reinforces the rule that you should never store secrets or sensitive personal data inside a JWT payload.
Frequently asked questions
Does this tool verify the token's signature?
No. It decodes and pretty-prints the header and payload, but it does not validate the cryptographic signature against a secret or public key. A token can be perfectly readable yet forged or tampered with. Always verify the signature server-side against the issuer's key before trusting any claim for authorization.
Is it safe to paste a live access token here?
Yes, in the sense that the decoding runs entirely in your browser with JavaScript — the token is never sent to any server, logged, or stored. That said, treat any live token as a credential: don't paste it into untrusted sites, and rotate it if you're unsure. This tool was built specifically to avoid the risk of sending tokens to a backend.
Why does my token show as expired when it just worked?
The exp claim is a Unix timestamp in seconds (not milliseconds). If you're comparing it against a millisecond clock, everything will look expired. Convert exp to a real date and compare it to the current UTC time. Also remember servers often allow a small clock-skew tolerance, so a token can be accepted a few seconds past its nominal expiry.
Can it decode the payload if it contains non-English characters?
Yes. JWT payloads are UTF-8 encoded before Base64URL encoding, and the decoder handles multi-byte characters, so names, emails, and other Unicode claim values render correctly rather than as mojibake.
It says my token is invalid — what's wrong?
The most common causes are a missing segment (a valid JWT has exactly two dots making three parts), extra whitespace or a stray 'Bearer ' prefix copied along with the token, or a truncated string. Paste only the raw three-part token. Note that encrypted JWTs (JWE) have five parts and cannot be plainly decoded here — only signed JWTs (JWS) are supported.
Related tools
Browse all free online tools in Text tools and more.
Frequently asked questions
Is my token sent to a server?+
No — decoding is done locally in your browser, your token stays private.