JWT · Decoder

How to decode a JWT (free)

1. Paste your JSON Web Token into the box on the left.
2. The header and payload are decoded instantly on the right.
3. Read the standard claims (issuer, expiry, subject) below the token.

What is a JWT?

A JSON Web Token is a compact, URL-safe way to represent claims between two parties. It has three parts separated by dots: a header (algorithm and type), a payload (the claims), and a signature. The first two are just Base64URL-encoded JSON — this tool decodes them so you can read exactly what a token contains.

Decoding vs. verifying

Decoding reveals the contents; verifying checks the signature to prove the token is authentic and unmodified. Verification needs the signing secret (HMAC) or public key (RSA/ECDSA) and must be done on a trusted server — never trust a token's claims in the browser without verifying them first.

Common claims

iss issuer, sub subject, aud audience, exp expiry time, iat issued-at, and nbf not-before. Time claims are Unix timestamps; this tool converts exp, iat and nbf to readable dates and flags an expired token.

Is my token safe here?

Yes. Tokens are sensitive credentials, so this tool never sends them anywhere. Decoding happens entirely in your browser tab — you can confirm in the network tab, and it works offline once the page has loaded.