How to Decode a JWT Token Online (Free)
JSON Web Tokens (JWTs) are the most common authentication token format in modern web APIs. They look like random strings, but they contain structured data you can read in seconds. This guide shows you how to decode a JWT to see its claims, user ID, and expiry — without a server or any additional tools.
What Is a JWT?
A JWT is a three-part string separated by dots: header.payload.signature. Each part is Base64URL-encoded.
- Header — the signing algorithm (HS256, RS256) and token type
- Payload — the claims: who the token is for, when it expires, and any custom data your app needs
- Signature — a cryptographic signature that proves the token hasn't been tampered with. You cannot verify this in a browser without the secret key — but you can still read the header and payload.
Step-by-Step Instructions
Find your JWT
JWTs typically live in: browser cookies (Application tab → Cookies in DevTools), localStorage (Application → Local Storage), the Authorization header in a network request (Network tab → Headers → Request Headers), or your app's API response.
Copy the full token
Select and copy the entire token — it starts with "eyJ" (the Base64 of {"typ":...) and contains exactly two dots. Make sure you copy the whole string, not just one segment.
Open the JWT Decoder
Go to the JWT Decoder tool. No login, no upload — the decoder runs entirely in your browser.
Paste the token
Paste the JWT into the input field. The three segments are parsed and decoded automatically.
Read the header
The header panel shows: alg (the signing algorithm — HS256 means HMAC-SHA256, RS256 means RSA-SHA256) and typ (usually "JWT"). This tells you how the signature was created.
Read the payload claims
Standard claims to look for: sub (the user's ID), exp (expiry, shown as both a Unix timestamp and a human-readable datetime), iat (when the token was issued), iss (the issuer — usually your auth server), aud (intended audience). Your app may also include custom claims like role, email, or plan.
Security Note: Don't Paste Real Tokens Publicly
The Gleanso JWT Decoder runs entirely in your browser — your token is never transmitted anywhere. However, if you use other online JWT decoders, be cautious: some tools are server-side, meaning your token is sent to a third-party server. A JWT is essentially a bearer credential — whoever has it can use it until it expires.
For debugging production issues, consider using a locally-running tool or redacting the token's signature before pasting. For development and staging tokens, online tools like this one are fine.
Common JWT Debugging Scenarios
- 401 Unauthorized? Check the
expclaim. If the token expired, the user needs to re-authenticate. - Wrong permissions? Check custom role or scope claims. Your API may not be reading the claim you expect.
- Wrong user? Verify
submatches the expected user ID. - Algorithm mismatch? Compare the
algin the header with what your server expects.