Free Online JWT Decoder & Token Inspector

What is JWT decoding?

JWT decoding converts the Base64URL-encoded header and payload into readable JSON. These sections are encoded, not encrypted, so anyone who has a token can usually read its claims.

Decoding is not verification

A decoded token can still be forged, altered, expired, intended for another audience, or signed with an untrusted key. Authentication systems must verify the signature and validate issuer, audience, expiry, not-before, and other application rules.

Standard time claims

• iat: the time the token was issued.
• exp: the time after which the token must not be accepted.
• nbf: the time before which the token must not be accepted.

Security guidance

Do not paste production bearer tokens into tools you do not trust. This implementation decodes locally and does not include token values in analytics, logs, requests, or URLs.

How to use JWT Decoder & Token Inspector

1. Paste a compact three-section JWT; an optional Bearer prefix is accepted.
2. Select Decode JWT to inspect the header, payload, signature section, and standard claims.
3. Review readable timestamps and expiry status.
4. Verify signatures and claims inside your trusted application or identity platform before accepting a token.

Input and output example

Example input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MiIsImV4cCI6MTg5MzQ1NjAwMH0.signature

Example output

Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "42", "exp": 1893456000 }

Troubleshooting

• A signed JWT normally has exactly two dots and three sections.
• Base64URL differs from ordinary Base64 by using - and _ characters.
• A decoded payload can be readable even when the signature is invalid.

Limitations

This workspace decodes JWS compact tokens. It does not decrypt JWE tokens, fetch remote keys, establish trust, or make authorization decisions.

Developer tips

• Never store secrets in a JWT payload.
• Validate issuer, audience, expiry, not-before, token type, and application rules.
• Use short-lived production tokens and a tested revocation strategy.

Browser compatibility

Current versions of Chrome, Edge, Firefox, and Safari are supported. File, clipboard, Web Crypto, worker, canvas, and download capabilities can vary by browser and security context; the interface reports unavailable operations rather than uploading data as a fallback.

Supported formats

Keyboard shortcuts