JWT Decoder
Decode a JSON web token.
Loading tool…
About JWT Decoder
Paste any JSON Web Token and this decoder splits it on the dots, base64url-decodes the header and payload, and pretty-prints each as formatted JSON. It highlights the signing algorithm and type, and turns the exp, iat, and nbf claims into human-readable dates with an at-a-glance expired or valid badge.
It is completely free with no sign-up, and everything runs entirely in your browser — your token is never uploaded to a server. Note that the signature is not verified, so the tool reads a token's contents without confirming it is authentic.
Frequently asked questions
- Is the JWT decoder free to use?
- Yes, it is completely free with no account, sign-up, or usage limits. Decode as many tokens as you need.
- Is my token uploaded or stored anywhere?
- No. The decoding happens entirely in your browser using JavaScript. Your JWT never leaves your device, is never sent to any server, and is not logged or stored. It is safe to paste tokens that contain sensitive claims.
- Does this tool verify the token's signature?
- No. It only decodes and displays the header and payload. It does not check the signature, so a decoded token is not proof that the token is authentic or untampered. Always verify the signature on your server with the correct secret or public key before trusting a token.
- What do alg and typ mean?
- The alg field is the algorithm used to sign the token, such as HS256, RS256, or ES256. The typ field is the token type, almost always JWT. Both come from the token's header, which this tool decodes and displays for you.
- How are the exp, iat, and nbf timestamps handled?
- JWTs store these as Unix epoch seconds. The tool converts them to readable local and UTC dates. It also compares exp and nbf against the current time to show whether the token is expired, not yet valid, or still valid.
- Why does it say my token is malformed?
- A valid JWT has exactly three parts separated by dots (header.payload.signature), and the header and payload must be base64url-encoded JSON objects. If a part is missing, empty, or not valid base64url JSON, the tool shows an error instead of guessing.