JWT Decoder
Decode JWT tokens online to inspect the header and payload without sending them to a server. Useful for debugging auth flows, checking claims, and quickly reading token contents in your browser.
Decode JWTJWT parserInspect payloadClient-side
Display-only decoder. Signature verification requires the shared secret and is not performed.
How to use
- Paste your JWT. Three dot-separated base64url parts.
- Inspect header and payload. Claims and metadata are shown in readable JSON.
- Review token structure. The signature section is shown, but verification is not performed here.
Common use cases
- Debugging auth flows
- Inspecting OAuth tokens
- Learning JWT structure
Frequently asked questions
- What is this JWT decoder best for?
- Reading the header and payload of a JSON Web Token during login debugging, auth integration checks, and API troubleshooting. It also humanizes timestamp claims like iat, exp, and nbf so you can see them as readable dates.
- Does this tool verify the JWT signature?
- No. This page is for decoding and inspection only. Signature verification needs the shared secret or public key for the algorithm in the header (HS256, RS256, ES256, etc.) and is intentionally not done client-side.
- Can I use this tool to inspect token claims like exp or aud?
- Yes. Standard claims (iss, sub, aud, exp, nbf, iat, jti) and custom payload fields are all visible. Timestamp claims are also rendered as ISO dates so you can confirm whether a token has expired.
- Is the token I paste sent to a server?
- No. The token is base64url-decoded entirely in your browser. Nothing is logged, transmitted, or stored.
- Which JWT specification does this follow?
- It follows RFC 7519 (JWT) and the underlying RFC 7515 (JWS) compact serialization: three base64url-encoded segments (header.payload.signature) separated by dots.
Related tools
How to use
- Paste your JWT. Three dot-separated base64url parts.
- Inspect header and payload. Claims and metadata are shown in readable JSON.
- Review token structure. The signature section is shown, but verification is not performed here.
Common use cases
- Debugging auth flows
- Inspecting OAuth tokens
- Learning JWT structure
Frequently asked questions
- What is this JWT decoder best for?
- Reading the header and payload of a JSON Web Token during login debugging, auth integration checks, and API troubleshooting. It also humanizes timestamp claims like iat, exp, and nbf so you can see them as readable dates.
- Does this tool verify the JWT signature?
- No. This page is for decoding and inspection only. Signature verification needs the shared secret or public key for the algorithm in the header (HS256, RS256, ES256, etc.) and is intentionally not done client-side.
- Can I use this tool to inspect token claims like exp or aud?
- Yes. Standard claims (iss, sub, aud, exp, nbf, iat, jti) and custom payload fields are all visible. Timestamp claims are also rendered as ISO dates so you can confirm whether a token has expired.
- Is the token I paste sent to a server?
- No. The token is base64url-decoded entirely in your browser. Nothing is logged, transmitted, or stored.
- Which JWT specification does this follow?
- It follows RFC 7519 (JWT) and the underlying RFC 7515 (JWS) compact serialization: three base64url-encoded segments (header.payload.signature) separated by dots.