🧑‍💻

JWT Decoder

🔒 In your browser

Decode a JWT's header, payload & claims — see expiry instantly.

JWT

Decoding only — the signature is not verified here. Use the JWT Verifier to check it.

🔒 Your token and secret never leave your browser — everything runs locally via the Web Crypto API.

🔒 Private by design: tokens, secrets, and keys are processed entirely in your browser with the Web Crypto API — nothing is sent to a server, stored, or logged. Even so, avoid pasting production secrets into any online tool.

About the JWT Decoder

A JSON Web Token (JWT) is a compact, signed token used for authentication and authorization. This free JWT decoder splits a token into its header, payload and signature and shows the claims — including expiry — in readable JSON, so you can debug auth issues fast.

Decoding happens entirely in your browser with the Web Crypto API; your token is never uploaded.

How to decode a JWT

Paste the token (three Base64url parts separated by dots).
Read the decoded header and payload, with standard claims like exp, iat and iss explained.
See at a glance whether the token has expired.

Reading a token's claims

A decoded JWT reveals its header (the signing algorithm) and payload (the claims). Standard claims worth knowing: exp is the expiry, iat when it was issued, sub the subject (usually a user id), iss the issuer and aud the intended audience. This tool highlights the expiry so you can immediately see whether a token is still valid.

Frequently asked questions

What is a JWT?

A JSON Web Token is a signed, URL-safe token with three parts — header, payload and signature — used to securely convey claims such as who a user is and what they can access.

Does decoding a JWT verify it?

No. Decoding just reveals the contents; it doesn't check the signature. Use a JWT verifier with the signing secret or public key to confirm the token is authentic.

Is it safe to paste a token here?

The token is decoded locally in your browser and never sent to a server. Even so, avoid pasting live production tokens into any online tool.

Does decoding a JWT verify it?

No. Decoding just reveals the contents — it doesn't check the signature. A JWT is only Base64url-encoded, not encrypted, so anyone can read it. Use the JWT Verifier with the secret or public key to confirm a token is authentic.

Learn more

Related Developer tools

JWT Encoder / Generator JWT Verifier JSON Formatter & Validator JSON Tree Viewer JSON Diff / Compare

🔗 Embed this tool on your website — free

Copy this and paste it into your page's HTML. The tool runs in the visitor's browser, just like here. Change height to fit, or add the optional auto-resize snippet below. Add ?theme=dark to the URL for dark mode.

<iframe src="https://toolhq.dev/embed/jwt-decoder/" title="JWT Decoder — ToolsHub" width="100%" height="520" style="border:1px solid #e5e7eb;border-radius:12px;max-width:680px" loading="lazy"></iframe>

Optional: auto-resize the iframe height

Add this once on the same page so the iframe grows to fit the tool:

<script>
addEventListener("message", function (e) {
  if (e.data && e.data.type === "toolshub:resize") {
    document.querySelectorAll('iframe[src*="/embed/"]').forEach(function (f) {
      if (f.contentWindow === e.source) f.style.height = e.data.height + "px";
    });
  }
});
</script>