Header: algorithm and type
The header can declare values such as alg, typ, and kid. They describe what the token says about itself; this page does not verify that an algorithm or key is acceptable for your application.
Free online developer utility · no registration or login
Free JWT Decoder Online
Inspect JWT headers, payloads, claims, expiry times, and signature segments in your browser. Decode locally with no login; this tool does not verify signatures.
- Compact three-segment tokens
- Header, payload, and time claims
- Segment-aware decode errors
- Decoder only · signature not verified
JWT inspection workspace
Decode a compact token
This free online JWT decoder runs in your browser with no registration or login. It reads a compact token for inspection and does not verify the signature.
Paste a complete three-segment compact token. A leading Bearer prefix is removed locally before decoding.
Decoder only: the signature, algorithm, claim values, and browser-clock time hints are not verification.
0 characters
Keyboard shortcut: Ctrl/Command + Enter. The source token is not changed if decoding fails.
Result
Decode a compact token to inspect its segments and claims.
Formatted header and payload JSON, the raw signature segment, standard claims, and readable time values will appear here.
How to inspect a JWT
Inspect what a token says, then keep actual verification with the application responsible for accepting it.
- Step 1
Paste the compact token
Paste the complete header.payload.signature value. A leading Bearer prefix is accepted and removed locally before decoding.
- Step 2
Read the decoded JSON
Review header metadata, payload claims, the raw signature segment, and any available exp, nbf, or iat time fields.
- Step 3
Verify in your application
Treat every displayed value as untrusted until your server or trusted SDK verifies the signature, issuer, audience, time window, and allowed algorithm.
Understand the decoded token
A compact signed token has three dot-separated Base64url segments. This decoder makes each segment legible without changing it or claiming that it is authentic.
Payload: claims and custom data
The payload is readable JSON with registered and custom claims. Use it to inspect a debugging value, but do not store secrets in a plain signed-token payload.
Signature: present, not verified
The third segment is displayed exactly as supplied. Its presence is structural information only and does not prove that the token was signed by a trusted issuer.
Read common JWT claims
The result panel surfaces available claims without inventing missing values. Time displays are useful for debugging and are calculated from this browser's clock.
Expiration, not before, and issued at
exp, nbf, and iat are NumericDate values. Review their UTC and local representations, then apply the validation and clock-skew policy required by your service.
Issuer, subject, and audience
iss identifies a claimed issuer, sub a claimed subject, and aud the intended audience. Their meaning and acceptable values belong to your relying application's configuration.
JWT ID and custom claims
jti and custom fields are shown with the rest of the payload. This tool does not interpret business semantics or determine whether a claim is authorized.
Decode is not verification
Readable JSON, an expiry badge, or an algorithm named in the header is not evidence that a token is trustworthy. Keep security decisions in your application or trusted identity library.
Readable does not mean authentic
Anyone holding a plain signed JWT can read its header and payload. A decoder cannot establish who issued it or whether someone altered it.
The header algorithm is untrusted input
Display alg to aid debugging, but configure allowed algorithms and keys on the verifying side. Do not select a verification policy from an unverified token header.
Use the right verification path
Verify cryptography and applicable issuer, audience, expiration, and not-before rules in the service or SDK responsible for accepting the token.
Fix common JWT decode errors
The workspace reports where decoding stopped so you can correct a copied, encoded, truncated, or unsupported token without guessing.
Three segments for compact JWS
This decoder expects header.payload.signature with exactly two dots. A missing or extra segment often means the value was copied incompletely or is not a compact signed token.
Five segments usually need JWE decryption
A five-segment compact value is commonly an encrypted JWE. It needs decryption keys and is outside the scope of this decoder.
Base64url, UTF-8, and JSON must all parse
The header and payload must use valid Base64url, decode as UTF-8, and contain JSON objects. The decoder names the failed layer and does not auto-repair input.
Privacy and limits
The decoder runs in this browser tab. It is free online with no registration or login, but decoded values still need correct verification in the system that uses them.
- This page decodes one compact three-segment token at a time. It does not decrypt five-segment JWE values, nested tokens, detached payloads, or batch input.
- Decoding, the signature segment, claim summaries, and browser-clock time hints do not verify authenticity, integrity, issuer, audience, or authorization.
- No secret, private key, public key, JWKS lookup, or signature-verification workflow is provided. Do not paste signing keys into this page.
- A JWT payload may be readable to anyone holding a plain signed token. Do not place passwords, private keys, or other confidential data in it.
JWT Decoder FAQ
Straight answers about compact-token structure, claims, expiry, browser processing, free access, and the line between decoding and verification.
Is this JWT Decoder free to use?
Yes. This JWT Decoder is free to use online and does not require registration or login.
Does this decoder verify a JWT signature?
No. It decodes the compact token for inspection only. Your application or a trusted SDK must verify the signature with the correct key and allowed algorithm before trusting claims.
How can I decode a JWT without a secret?
The header and payload in a compact JWT can be Base64url-decoded into readable data without a secret. A secret or public key is used for signature verification, which this page does not perform.
What does exp mean in a JWT?
The exp claim is an expiration NumericDate. This page converts it to UTC and browser-local time for debugging, but the displayed status is not token validation.
What are iat and nbf?
iat is the issued-at time and nbf is the not-before time. Both are optional NumericDate claims. Servers can apply their own clock-skew and validation rules.
Why does my JWT have five parts?
A five-segment compact token is commonly a JWE, an encrypted format. This page supports three-segment compact JWS-style tokens only and cannot decrypt JWE content.
Can I paste Authorization: Bearer followed by a token?
Yes. A leading Bearer prefix is removed locally before this decoder reads the compact token. The complete three-segment token is still required.
Are JWT payloads encrypted?
A three-segment signed JWT can be decoded by anyone holding it; its header and payload are not confidential simply because they are encoded. Encrypted JWT formats use a different structure and are outside this tool's scope.
Why can an expired token still be decoded?
Decoding reads the token's representation. Expiration affects whether a relying application should accept the token, not whether its header and payload can be displayed for debugging.
Does this page upload or store my token?
The decoder runs in this browser tab and does not require an account. Do not paste signing keys or treat a decoded result as a security decision.
Related Developer Tools
Continue with decoded JSON, Base64 text, NumericDate values, or URL-encoded request data.
Fd Developer
Format decoded JSON
Paste JSON or open a file to format, validate, beautify, or minify it. Choose indentation, review parser errors, and copy or download the result in your browser with no login.
Open tool DB Developer
Decode Base64 text
Encode or decode UTF-8 and URL-safe Base64 text online. Paste a value, copy the result, or download it from your browser without registration or login.
Open tool CJ Developer
Convert JWT timestamps
Convert Unix timestamps in seconds or milliseconds to UTC, local time, or ISO 8601. Convert dates back to timestamps online with no registration or login.
Open tool DU Developer
Decode URL components
Encode or decode URL components, full URLs, and query parameters with UTF-8 percent encoding. Copy the result online without registration or login.
Open tool