JWT Decoder and Token Inspector
Decode a JSON Web Token in your browser. See the header, payload, and signature,...Decode a JSON Web Token in your browser. See the header, payload, and signature, read every claim with real exp and iat dates, flag expired tokens, an...
Updated
Decoded entirely in your browser with JavaScript. Nothing you paste is uploaded, logged, or sent to any server.
Quick answer
To decode a JWT, paste the token into the box and its three Base64URL parts (header, payload, and signature) decode at once. The header and payload are just Base64URL-encoded JSON, so they can be read without any key, and this tool does it entirely in your browser: nothing you paste is uploaded. It shows each standard claim with a plain-English label, converts the exp, iat, and nbf timestamps into readable dates and relative phrases like expired 3 hours ago, and flags a token that is past its expiry. You can also paste an HMAC secret to verify an HS256, HS384, or HS512 signature locally with the Web Crypto API.
Decoder Features
Why Use JWT Decoder and Token Inspector?
Live Three-Part Decode
Paste a token and the header, payload, and signature split apart instantly, colour-coded, with the JSON pretty-printed so it is easy to scan.
Readable Dates and Expiry
The exp, iat, and nbf claims are shown as absolute dates and in plain words like expires in 2 days or expired 3 hours ago, with a clear expired flag.
Nothing Leaves Your Browser
Every token is decoded on your device with JavaScript. It is never uploaded, logged, or stored, which is why this is safe for production tokens.
Optional HS256 Verify
Paste an HMAC secret and the tool checks the signature locally with the Web Crypto API, showing a clear valid or invalid result. Your secret stays on the page.
Standard Claims Explained
Each registered claim (iss, sub, aud, exp, iat, nbf, jti) is labelled with what it means, so you do not have to keep the RFC open in another tab.
Friendly, Specific Errors
A truncated token, a missing part, or malformed Base64URL gets a clear message that names the problem instead of a blank screen or a crash.
Common Uses for the JWT Decoder
Debug Auth Failures
Inspect a token from an API response to see why a request returns 401, starting with the exp claim.
Security Review
Check the algorithm, audience, issuer, and expiry of a token against what your service expects.
Build and Test APIs
Confirm the payload your backend issues contains the right roles, scopes, and subject during development.
Learn How JWTs Work
See a real token pulled apart into header, payload, and signature to understand the format quickly.
How It Works
Paste your JWT
Copy the token from a cookie, an API response, or an Authorization header (a leading Bearer is stripped for you) and paste it into the box.
Read the header, payload, and claims
See the decoded header and payload as formatted JSON, with every standard claim labelled and each timestamp shown as a real date.
Check expiry, then copy or verify
An expired token is flagged at the top. Copy the header, payload, or whole token with one click, or paste an HS256 secret to verify the signature.
Tips and Security Notes
A JWT Is Not Encrypted
The payload is only Base64URL-encoded, so anyone can read it. Never put a password, an API key, or other secrets in JWT claims.
Check exp First
When an authenticated request suddenly fails, decode the token and read the exp claim before anything else. An expired token is the usual cause of a 401.
Decoding Is Not Verifying
Reading a payload proves nothing about who signed it. Verify the signature against the key before you trust any claim, especially in production.