Free JWT Decoder & Inspector Online
Decode and inspect JWT tokens instantly — view header, payload, and signature in a readable format. No verification, no server calls.
How it works
Paste your JWT
Paste the full JWT token (the three base64url-separated parts) into the input.
Decode
The decoder splits on "." and base64url-decodes each part.
Inspect claims
See the algorithm, issuer, subject, expiry, and all other claims in formatted JSON.
Note: decode-only
This tool decodes — it does not verify the signature. Use a proper library for verification.
Common use cases
Debugging auth issues
Inspect the claims inside an access or refresh token to verify the subject, roles, expiry, and issuer match what your API expects.
Token expiry checking
Decode the exp claim (Unix timestamp) to see exactly when a token expires — useful when debugging 401 errors.
Understanding JWT structure
Great for learning: see the algorithm in the header, standard claims (iss, sub, aud, iat, exp) in the payload, and the signature.
Testing authentication flows
Quickly verify that your auth server is embedding the correct custom claims (user ID, roles, tenant) in issued tokens.
Frequently asked questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It has three parts: header (algorithm), payload (claims), and signature — each base64url-encoded and separated by dots.
Is this tool verifying the JWT signature?
No. This tool only decodes (base64url-decodes) the header and payload. Signature verification requires the secret key or public key and should happen server-side.
Is it safe to paste my JWT here?
Your token is decoded entirely in your browser and never transmitted anywhere. However, avoid pasting production tokens containing sensitive data into any public tool as a general security practice.
What does the exp claim mean?
exp is a Unix timestamp (seconds since 1970-01-01 UTC) representing when the token expires. The decoder displays it as both the raw number and a human-readable date.
Why does my JWT have three parts separated by dots?
header.payload.signature — the first two are base64url-encoded JSON; the third is the cryptographic signature over header + payload.
What algorithms do JWTs use?
Common algorithms include HS256 (HMAC-SHA256, symmetric), RS256 (RSA-SHA256, asymmetric), and ES256 (ECDSA, asymmetric). The alg field in the header tells you which one.