This decoder accepts a three-part compact JWT, including tokens copied with an Authorization: Bearer prefix. It checks the structure, parses UTF-8 JSON and highlights the token's current time window. Your token stays in the browser and is not uploaded.
Free JWT Decoder
Runs entirely in your browser - no upload, no sign-up.
Paste a token to decode itThe header, payload, timestamps and signature segment will appear here.
What does a JWT decoder do?
A JWT decoder turns the Base64URL header and payload of a JSON Web Token into readable JSON. Paste a token to inspect its algorithm, claims and NumericDate timestamps such as exp, nbf and iat. Decoding happens in your browser, but it does not verify the token's signature or authenticity.
How to use
- 1Paste the JWT. Copy a compact token or Bearer value into the input. The decoder updates immediately.
- 2Read the header and payload. Inspect the formatted JSON, registered claims and human-readable UTC timestamps.
- 3Check the warnings. Use the time status and security notes as debugging clues, then verify the signature in your application.
- 4Copy what you need. Copy the decoded header, payload or raw signature segment for local debugging and documentation.
Who it's for
- API developers tracing authentication failures by inspecting issuer, audience, subject and custom claims.
- Frontend teams checking access-token expiry while debugging refresh and sign-in flows.
- Security reviewers spotting unsigned tokens, unexpected algorithms or malformed NumericDate claims before deeper verification.
- Support engineers reading a redacted token from a local test environment without writing a decoding script.
FAQ
Is the JWT decoder free?
Yes. The JWT decoder is free, requires no account and has no usage limit. It runs locally in your browser, so you can inspect development tokens without installing a package or sending the token to a decoding API.
Is my JWT uploaded?
No. Header and payload decoding happens in your browser with JavaScript. The tool does not upload the token for processing. Still, avoid sharing production access tokens in screenshots, tickets or messages because anyone who obtains a live bearer token may be able to use it.
How large a JWT can I decode?
The decoder has no artificial character limit, but browsers, proxies and application servers often impose practical header limits. Very large tokens can fail before reaching your application, so keep production JWT claims compact and avoid embedding bulky profile or permission data.
Does decoding a JWT verify its signature?
No. Decoding only reveals the encoded JSON. Signature verification requires the correct key, an allowed algorithm and application checks for claims such as issuer and audience. Never treat a decoded token as authentic until the system accepting it completes those checks.
How do I check whether a JWT is expired?
Read the exp claim as a NumericDate measured in seconds since the Unix epoch. The token must not be accepted at or after that time. This decoder converts exp to UTC and compares it with your browser's current clock, but the server remains authoritative.
Can anyone decode a JWT payload?
Anyone who has a standard signed JWT can usually decode its header and payload because Base64URL does not hide the contents. Do not place passwords, secrets or unnecessary personal data in claims. Encrypted JWE tokens use five segments and are outside this decoder's scope.
Why does the decoder show an invalid timestamp warning?
RFC 7519 defines exp, nbf and iat as NumericDate values: JSON numbers containing seconds since 1970-01-01T00:00:00Z. A string, an invalid number or a millisecond value can produce misleading dates and may be rejected by strict JWT libraries.