ToolFreeOnline

JWT Decoder

Decode JSON Web Tokens (JWT) to inspect their header and payload.

// JWT String

About the JWT Decoder

The JWT Decoder is an essential utility for developers working with authentication and authorization systems (like OAuth 2.0 or OIDC). It allows you to easily paste a JSON Web Token and instantly inspect its contents without needing a backend server or command-line tools.

Features

  • Automatic Splitting: Paste a raw JWT string and the tool automatically splits it into its three components: Header, Payload, and Signature.
  • Smart Formatting: The Header and Payload are instantly decoded from Base64URL and pretty-printed as syntax-highlighted JSON for easy reading.
  • Live Claim Inspection: Standard claims are automatically identified. Expiration (`exp`), Issued At (`iat`), and Not Before (`nbf`) timestamps are converted into human-readable local dates, with a live check showing if the token is currently expired.
  • Privacy First: Your tokens often contain sensitive session data. This tool runs 100% locally in your browser, guaranteeing that your tokens never leave your machine.

Simply paste your token into the top input field. The decoded information will immediately appear below, with handy copy buttons for each section.

Frequently Asked Questions

What is a JWT token?

A JSON Web Token (JWT) is an open standard that defines a compact, self-contained way for securely transmitting information between parties as a JSON object. They are commonly used for user authentication and authorization in web applications.

How do I decode a JWT without a library?

A JWT is composed of three Base64Url-encoded parts separated by periods (Header, Payload, and Signature). You can manually decode the first two parts using any Base64 decoding tool, or use our specialized decoder to instantly view the formatted JSON claims.

Does this tool verify the JWT signature?

No. This tool is designed purely to decode and display the Header and Payload claims for debugging purposes. It does not perform cryptographic signature validation, which requires access to the secret key or public certificate.

What does the "exp" claim mean in a JWT?

The 'exp' (Expiration Time) claim identifies the exact date and time on or after which the JWT must not be accepted for processing. It is defined as a standard Unix timestamp (seconds since epoch) to prevent replay attacks using old tokens.

Is it safe to paste my JWT here?

Yes. Our JWT Decoder operates 100% locally in your web browser via JavaScript. Your tokens are decoded directly on your device and are never transmitted to, or stored on, any remote servers.