JWT Decoder
Paste a JWT token to decode its header, payload, and claims instantly.
- Free
- No account
- Runs in your browser
- Nothing uploaded
Runs entirely in your browser — your input is never uploaded, logged, or stored.Privacy policy
What is JWT Decoder?
A JSON Web Token (JWT) is a compact, URL-safe string that carries claims between two parties. APIs use them for authentication: the server signs a token, the client sends it back with each request, and the server verifies the signature. The token itself is not encrypted — it is base64url-encoded JSON, which means anyone can read the contents.
That is what this tool does: it takes the token string you get from a login response, an Authorization header, or a browser cookie, and decodes it into readable JSON. You see the header (which algorithm signed it), the payload (the actual claims like user ID, roles, and expiration time), and the raw signature.
It is for developers debugging authentication flows: checking whether a token is expired, reading what claims it carries, verifying which algorithm signed it, or troubleshooting why an API is rejecting a request. The tool does not verify the signature — it decodes what is there. Signature verification requires the signing key, which is the server's secret.
A JWT is three base64url-encoded segments separated by dots: `header.payload.signature`. The decoder:
1. Splits the input on `.` characters — a valid JWT has exactly 3 segments (JWS) or 5 segments (JWE encrypted JWT, which this tool also decodes). 2. Base64url-decodes each segment. Base64url uses `-` and `_` instead of `+` and `/`, and omits `=` padding (RFC 4648 §5). 3. Parses the header and payload as JSON. 4. For the payload, converts Unix timestamp claims (`exp`, `nbf`, `iat`) into human-readable dates.
This is decoding, not verification. The signature is displayed but not checked — verifying a signature requires the signing key, which is never present in the token itself.
Worked examples
- RFC 7519 example token decodes to header {"alg":"HS256","typ":"JWT"} and payload {"exp":1300819380,"iss":"joe","http://example.com/is_root":true}.
- The payload's exp claim of 1300819380 converts to 2011-03-22T18:43:00.000Z — the tool labels it as expired.
- A token with 4 segments (header.payload.encrypted.claims) is a JWE — the tool decodes the header and identifies it as encrypted.
How to use JWT Decoder
- Paste the full JWT token into the input box — the one from your Authorization header, login response, or cookie.
- Read the decoded header to see which algorithm (HS256, RS256, etc.) signed the token.
- Read the decoded payload to see all claims — user ID, roles, expiration, issuer, and any custom claims.
- Check the expiration claim (exp) — the tool shows whether the token is expired and how long ago.
Common errors
- Token shows as expired — the exp claim is a Unix timestamp. If it is in the past, the token is expired. Your API likely issued a new token; check your refresh flow.
- Payload shows garbled text — the token may not be base64url. Some systems use standard base64 with + and / instead of - and _. The tool tries both, but some tokens are malformed.
- Header shows alg: none — this is an unsecured JWT with no signature. Never trust a token with alg: none in production; it means anyone can forge it.
- Token has 5 segments — it is a JWE (encrypted JWT). The tool decodes the header but the payload is encrypted and cannot be read without the decryption key.
FAQ
Does this tool verify the JWT signature?
No. It decodes the header, payload, and signature — but does not verify the signature. Verification requires the signing key (the secret or public key), which is not in the token. The tool is for reading and debugging, not for trust decisions.
Can I use this tool to read tokens from my browser cookies?
Yes. Open your browser's developer tools, copy the token value from the cookie or Authorization header, and paste it here. The tool never sends the token anywhere — everything runs in your browser.
What does exp, nbf, and iat mean in the payload?
These are Unix timestamps: exp is when the token expires, nbf is when it becomes valid (not before), and iat is when it was issued. The tool converts them to human-readable dates.
What's the difference between JWS and JWE?
JWS (JSON Web Signature) is a signed but readable JWT — three segments. JWE (JSON Web Encryption) is an encrypted JWT — five segments where the payload is ciphertext. This tool decodes both, but can only show the payload contents of JWS tokens.
Is it safe to paste my JWT token here?
Everything runs locally in your browser — nothing is sent to any server. However, treat the token as sensitive data: anyone with a valid JWT can impersonate the user. Don't paste tokens from production systems onto shared machines.
Related tools
Prefer AllUtil on Google
One click adds AllUtil to your Google preferences. You'll see our tools highlighted with a Preferred badge in Search and AI answers.