Decode and inspect JSON Web Tokens (JWT) in your browser.
The JWT Decoder shows the header and payload of a JSON Web Token, converts the iat, nbf and exp claims to readable dates and tells you whether the token is expired. It also checks the token structure and flags unsigned "none" tokens. Decoding happens in your browser and the token is never sent anywhere.
Made for developers. Typical uses:
The sample token from the JWT documentation has the header {"alg":"HS256","typ":"JWT"} and the payload {"sub":"1234567890","name":"John Doe","iat":1516239022}. The decoder shows the algorithm HS256, the subject 1234567890, an issue time of 2018-01-18 01:30:22 UTC, and a warning that the token has no exp claim and so never expires.
It decodes and checks structure and claims but does not verify the signature, which needs the issuer's secret or public key, so never trust a token just because it decodes. Encrypted tokens (JWE) cannot be read without the key.
Accuracy: Output is tested against known inputs. For production code, review the result and run your own tests.
Expert Tip
Treat every token as a credential. Decode tokens from test systems freely, but avoid pasting live production tokens anywhere, and always verify the signature, expiry, issuer and audience on the server that receives the token.
A JSON Web Token is three parts separated by dots: a header, a payload and a signature. The header and payload are JSON written in a URL-safe form of Base64, and anyone who holds the token can read them. The JWT Decoder splits the token, decodes the first two parts and shows them formatted.
Take the well-known sample token from the JWT documentation. Its header is {"alg":"HS256","typ":"JWT"}, which says it was signed with HMAC and SHA-256, and its payload is {"sub":"1234567890","name":"John Doe","iat":1516239022}.
The payload contains claims. The standard ones are short names with specific meanings, and the tool turns the time claims into readable dates.
The sample token has no expiry claim, so the tool reports "No exp claim, so this token never expires", which is worth noticing because tokens that never expire are a risk if they leak. It also checks that the token has the right structure and flags the unsigned "none" algorithm, which should never be accepted by a server.
Reading a token is not the same as trusting it. Anyone can create a token with any payload. Only the signature proves that the issuer created it, and checking the signature needs the secret or public key, which this tool does not have. A server must always verify the signature, the algorithm, the expiry, the issuer and the audience before it trusts a token. Encrypted tokens (JWE) cannot be read without the key at all.
A live token is a credential: whoever holds it can act as the user until it expires. This tool decodes in your browser and sends nothing anywhere, but you should still avoid pasting production tokens into tools you do not trust, and revoke any token that has been shared by mistake. For related tasks, the Base64 Encoder Decoder shows how the parts are encoded, the JSON Formatter tidies the payload, and the Unix Timestamp Converter converts the date claims.
Most token errors come down to a handful of causes: the token has expired, its clock is a few seconds ahead of or behind the server, it was issued for a different audience or issuer, or the wrong key was used to check the signature. Decoding the claims here shows the dates and values side by side, so you can see which one is out of line. Remember that expiry times are in UTC and are written as seconds since 1970.
Base64 is not encryption and a hash cannot be reversed. See what each does, where JWTs and URL encoding fit, and how to pick MD5, SHA-256 or a password hash.
Explore more in Developer Tools, read the guides and articles, or see how we test our tools.
Encode text and data to Base32 format.
Best for generating or inspecting a Base32-encoded TOTP secret key for two-factor authentication setup
Encode and decode Base64 strings instantly.
Best for encoding binary data for email and web transmission
Check color contrast ratios for WCAG compliance.
Best for checking that body text color meets WCAG AA contrast requirements before shipping a website
Parse and understand cron expressions with human-readable descriptions.
Best for confirming a scheduled job in a server crontab actually runs when you think it does before deploying it
Convert external CSS to inline styles for HTML emails.
Best for converting a designed HTML email template into inline-styled markup before sending a campaign
Format and beautify messy CSS code with proper indentation.
Best for beautifying minified CSS for editing
Test REST APIs with visual interface.
Best for quickly testing an API endpoint without installing a full API client