JWT Decoder
Inspect a JSON Web Token
Signature is not verified — this tool only decodes the token. Decoding happens entirely in your browser; the token is never uploaded.
What Is the JWT Decoder?
The JWT Decoder lets you inspect any JSON Web Token by decoding its header and payload into readable JSON and showing claims like issuer, subject, and expiry. Decoding happens entirely in your browser — your token never leaves the page — so it is safe to debug auth tokens, check expiry, and understand what a JWT contains.
Key Features
What Is a JWT?
A JSON Web Token is a compact, signed token used for authentication and information exchange. It has three parts — a header, a payload of claims, and a signature — separated by dots and Base64URL-encoded. Decoding reveals the header and payload so you can see who issued the token, who it is for, and when it expires.
Decoding vs Verifying
This tool decodes a JWT to show its contents, which is what you need for debugging and inspecting claims. Decoding is not the same as verifying the signature — that requires the secret or public key and confirms the token is authentic and untampered. Never trust a decoded token’s claims without server-side verification.
Common Use Cases
- Debugging authentication tokens during development
- Checking when a token expires
- Inspecting the claims inside an API token
- Understanding the structure of a JWT
Frequently Asked Questions
Is it safe to decode my JWT here?
Yes. Decoding happens entirely in your browser using client-side JavaScript, so your token is never sent to or stored on any server. Still, avoid sharing tokens that are currently valid.
Does decoding a JWT verify it?
No. Decoding only reveals the header and payload. Verifying the signature requires the signing key and confirms the token is authentic and unmodified — always do that server-side before trusting any claims.
Why can anyone read my JWT payload?
A JWT payload is only Base64URL-encoded, not encrypted, so anyone with the token can read its claims. That is why you should never store sensitive secrets in a JWT payload.
What do iss, sub, and exp mean?
These are standard claims: iss is the issuer, sub is the subject (usually the user), and exp is the expiry timestamp. The decoder highlights these so you can quickly understand a token.
Is the JWT decoder free?
Yes, it is completely free with no account required, and all decoding is done locally in your browser.
Need more developer utilities?
Explore all tools