JWT decoder & inspector
Decode and inspect JSON Web Tokens (JWT) instantly. View header, payload claims, and expiration without any server-side processing. 100% client-side.
- Free, no sign-up
- No data stored
- Reviewed 2026-08-01
Your details
Results
About the JWT Decoder
JSON Web Tokens (JWT) are the standard format for transmitting authentication and authorisation data between services. This decoder lets you paste any JWT and instantly see the decoded header, payload, and signature status — all processed in your browser with nothing sent to a server.
The tool displays all standard claims (iss, sub, aud, exp, nbf, iat, jti) with human-readable timestamps and highlights expired tokens in red. Custom claims are shown in a structured JSON tree for easy inspection.
Use this when debugging OAuth flows, verifying API tokens, checking claim values, or teaching team members how JWTs work. Since decoding happens entirely client-side, your tokens remain private and secure.
How to use the JWT Decoder
- Paste your JWT string (all three dot-separated parts) into the input field.
- The header section shows the algorithm and token type.
- Review the payload claims including issuer, subject, and expiration.
- Check the expiration status — expired tokens are flagged automatically.
- Copy individual sections or the formatted JSON for documentation.
Frequently asked questions
Is it safe to paste my JWT here?
Yes. Decoding is performed entirely in your browser using JavaScript. No data is transmitted to any server. You can verify this by disconnecting from the internet and using the tool offline.
Can this tool verify the signature?
This tool decodes and displays the token contents. Signature verification requires the secret or public key, which is not collected here for security reasons. Use a backend library for full verification.
What does the "exp" claim mean?
The "exp" (expiration time) claim is a Unix timestamp after which the token should be rejected. The tool converts this to a human-readable date and shows whether the token is currently valid or expired.
Why are there three parts separated by dots?
A JWT consists of three Base64URL-encoded sections: the header (algorithm metadata), the payload (claims/data), and the signature (integrity verification). Each is separated by a period character.
Sources
Figures are estimates for guidance only. Always confirm with the official source or a qualified professional before acting on them.