JWT Decoder — Decode and Inspect JWT Tokens Online
FreeDecode JWT tokens instantly. View header, payload claims, expiry, and algorithm without a secret key. Free, browser-based, no upload.
What's next
Settings guide
What each part shows:
- ·Header — Algorithm (
alg: HS256, RS256, ES256) and token type (typ: JWT). The algorithm tells you whether it is HMAC symmetric (HS256) or asymmetric RSA/ECDSA (RS256/ES256). - ·Payload — All claims. Standard claims:
sub(subject/user ID),iss(issuer),aud(audience),exp(expiry Unix timestamp),iat(issued-at timestamp),nbf(not-before). Custom claims are shown as-is. - ·Expiry status — The
expclaim is compared to the current time. Expired, active, and time-until-expiry are shown clearly. - ·Signature — Displayed as raw Base64url but not validated. A note confirms whether the algorithm supports server-side validation.
Format comparison
JWT decoder vs JWT validator: Decoding reads the token's content — no secret key needed, no network call. Validation cryptographically verifies the signature — requires the signing secret or public key, must be done server-side. Never send your signing secret to an online tool. Decode here; validate in your backend code.
HS256 vs RS256 tokens: HS256 (HMAC-SHA256) uses the same secret to sign and verify — shared secret, both parties must know it. RS256 uses a private key to sign and a public key to verify — the public key can be shared freely. If you see RS256 in the header, the token was signed with a private key and can be verified with the corresponding public key (often available at the issuer's JWKS endpoint).
How it works
Split on dots
The JWT is split at the two dot separators into three segments: header, payload, and signature. A valid JWT always has exactly two dots — three segments.
Decode Base64url
The header and payload segments are Base64url-decoded (replacing - with + and _ with /) and then JSON-parsed to reveal their key-value contents.
Parse claims
Standard claims are identified and formatted: exp and iat Unix timestamps are converted to human-readable dates. The exp claim is compared to the current time to show expiry status.
Display structure
Header and payload are displayed as formatted JSON with claim names annotated. The raw signature is shown but not validated — validation requires the signing secret, which stays on your server.
About this format
A JWT (JSON Web Token) is three Base64url-encoded segments joined by dots: `header.payload.signature`. The header and payload are plain JSON — readable without a secret key. The signature verifies integrity but requires the secret to validate.
Paste any JWT and see the decoded header (algorithm, token type), full payload with all claims (sub, iss, aud, exp, iat, and any custom claims), and a human-readable expiry timestamp. Useful for debugging authentication failures, confirming which user a token represents, and inspecting claim values during development.
The signature is not validated — this tool is for inspection only. Signature verification requires the signing secret, which should never leave your server.