Decode and inspect JSON Web Tokens
Paste your JWT
Enter the JSON Web Token you want to decode and inspect.
View decoded parts
See the header, payload, and signature sections decoded and formatted.
Check expiration
View the token expiration time and other claims in the payload.
Yes, the JWT Decoder is completely free to use. All decoding happens in your browser using JavaScript, so your tokens are never sent to any server. This is critical for security since JWTs often contain sensitive information and access credentials.
Absolutely. JWT decoding is performed entirely client-side in your browser. Your tokens never leave your device, and no data is logged or stored. This makes it safe to decode tokens containing sensitive claims like user IDs, permissions, or session data.
A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three parts: a header (algorithm and token type), a payload (claims/data), and a signature. The signature verifies the token has not been tampered with, though this tool only decodes without verifying signatures.
This tool decodes and displays JWT contents but does not verify signatures. Signature verification requires the secret key or public key used to sign the token, which should never be shared in a client-side tool. For production signature verification, use server-side libraries with proper key management.
Common claims include: iss (issuer - who created the token), sub (subject - who the token is about), aud (audience - intended recipients), exp (expiration time), iat (issued at time), and nbf (not before - when the token becomes valid). The tool highlights expiration status to help identify expired tokens.