JWT Decoder

Inspect JSON Web Token claims without sending them anywhere.

Processed locally — nothing is uploaded

Decoding only — the signature is never verified and no secret is required. Everything stays in your browser.

About JWT Decoder

Decoding is not verification. A JWT payload is Base64-encoded, not encrypted, so anyone holding the token can read it, and reading it here proves nothing about whether the signature is valid. Treat any production token you paste anywhere as exposed.

Paste a JSON Web Token to read its header and payload — issuer, audience, scopes and expiry — without needing a secret. Decoding happens in your browser and the token is never uploaded.

Decode a JSON Web Token's header and payload to inspect its claims, issuer, audience and expiry. JWTs are widely used for authentication and API authorisation, and being able to read them quickly is essential when debugging login flows.

The payload carries claims like issuer, audience and expiry, which is usually enough to explain why a login failed. An expired token and one signed with the wrong key look identical to the user, but the exp claim separates them in seconds.

Learn how this works

A Practical Guide to Everyday Developer Encoding & FormattingHow and when to use Base64, JSON formatting, hashing, JWTs, regex and cron — with free in-browser tools for each task.11 min read

Frequently asked questions

Do I need the signing secret to decode a token?

No. A JWT's header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read its claims. The secret is needed to *verify* the signature, which is a different operation.

Is it safe to put sensitive data in a JWT?

No — and this is the most common mistake with them. Because the payload is readable by anyone with the token, it should carry identifiers and claims, never passwords, personal data or anything you would not print in a log.

What do exp, iat and nbf mean?

Standard claims, all Unix timestamps: exp is when the token expires, iat when it was issued, and nbf the earliest time it may be accepted. An 'expired token' error is usually exp compared against a server clock that has drifted.

Common Use Cases

•Checking why an API rejected a token as expired or invalid
•Inspecting which claims and scopes a token actually carries
•Confirming an auth provider is issuing the fields you expect

More JWT Decoder tools