JWT Decoder
Decode a JSON web token.
Decode a JSON web token.
How to use JWT Decoder
- Paste your JSON Web Token into the input box
- View the decoded header and payload as pretty-printed JSON
- Check the algorithm and the expired-or-valid claim badge
About JWT Decoder
Paste any JSON Web Token and this online decoder splits it on the two dots, base64url-decodes the header and payload, and pretty-prints each as neatly formatted JSON. It surfaces the signing algorithm (alg) and token type (typ) from the header, and turns the exp, iat, and nbf claims into readable local and UTC dates with an at-a-glance badge that tells you whether the token is expired, not yet valid, or still good.
Because a JWT is just base64url text, it does not matter where the token came from. Tokens issued by Microsoft Entra ID / Azure AD, ones you copied out of a browser cookie, or the access token your React or Python app is holding all decode the same way — drop the whole header.payload.signature string in and read the claims. One thing it does not do is encode or re-sign tokens: creating a JWT needs the issuer's secret or private key, which the tool never has, so this is a read-only decoder rather than an encoder/decoder pair. For the same reason it cannot recover a signing secret or "decode" the signature — that final segment is a cryptographic hash, not readable data, and checking it requires the key on your server.
The decoder is completely free with no sign-up or limits, and every step happens entirely in your browser — your token is never uploaded, logged, or stored, so it is safe to paste tokens that carry sensitive claims.
Frequently asked questions
- Is the JWT decoder free to use?
- Yes, it is completely free with no account, sign-up, or usage limits. Decode as many tokens as you need.
- Is my token uploaded or stored anywhere?
- No. The decoding happens entirely in your browser using JavaScript. Your JWT never leaves your device, is never sent to any server, and is not logged or stored. It is safe to paste tokens that contain sensitive claims.
- Does this tool verify the token's signature?
- No. It only decodes and displays the header and payload. It does not check the signature, so a decoded token is not proof that the token is authentic or untampered. Always verify the signature on your server with the correct secret or public key before trusting a token.
- What do alg and typ mean?
- The alg field is the algorithm used to sign the token, such as HS256, RS256, or ES256. The typ field is the token type, almost always JWT. Both come from the token's header, which this tool decodes and displays for you.
- How are the exp, iat, and nbf timestamps handled?
- JWTs store these as Unix epoch seconds. The tool converts them to readable local and UTC dates. It also compares exp and nbf against the current time to show whether the token is expired, not yet valid, or still valid.
- Why does it say my token is malformed?
- A valid JWT has exactly three parts separated by dots (header.payload.signature), and the header and payload must be base64url-encoded JSON objects. If a part is missing, empty, or not valid base64url JSON, the tool shows an error instead of guessing.
- Can I decode a Microsoft or Azure AD token?
- Yes. Tokens from Microsoft Entra ID (Azure AD), including id_tokens and access tokens, are standard JWTs, so pasting one in decodes its header and payload like any other. You will see claims such as aud, iss, tid, and the roles or scopes Microsoft includes.
- How do I decode a JWT stored in a cookie?
- Copy just the token value from the cookie — the long header.payload.signature string, without the cookie name or attributes like Path or HttpOnly — and paste it in. The decoder treats it like any other JWT and shows the claims stored inside.
- Can this tool encode or create JWTs too?
- No, this is a decoder only. Building or re-signing a JWT requires the issuer's secret or private key, which stays on the server that mints the token, so a browser tool cannot safely encode one. Use this to read tokens, and generate them from your backend or auth library.
- Can it recover the JWT secret or signing key?
- No. The signing secret or private key is never part of the token — only a signature computed from it is — so there is nothing inside the JWT to extract it from. Anyone claiming to decode a secret from a token is brute-forcing a weak key offline, not reading it out.
- Can I decode the signature part of a JWT?
- The signature is the third segment, after the second dot. It is a cryptographic hash, not encoded JSON, so there is nothing human-readable inside — decoding it would just give random-looking bytes. Its job is verification, done by recomputing it with the key, not by reading it.
- How do I decode a JWT in a React app?
- For a quick look, just paste the token here. Inside a React app, the common approach is the jwt-decode package, which reads the payload client-side the same way this tool does. Remember it only decodes, so never trust the contents for authorization without verifying the signature on your server.
- How do I decode a JWT in Python?
- In Python the usual library is PyJWT: jwt.decode(token, key, algorithms=[...]) both decodes and verifies, or you can pass options to skip verification for inspection. This web tool does the same read-only decoding with no setup when you just need to eyeball a token's claims.