JWT Decoder

Decode JWT headers and payloads in your browser. No verification, no uploads—just quick inspection.

Samples:

Decode JWTs locally. No verification is performed and secrets should never be pasted—this tool is for inspecting headers and payloads only.

JWT (header.payload.signature)

0 characters

Header

Payload

Signature

No signature segment provided

This tool only decodes the JWT header and payload. It does not verify signatures or validate tokens. Avoid pasting secrets or private data.

Loading Tool…

JWT Decoder & Debugger (JSON Web Token)

Decode, inspect, and debug JSON Web Tokens (JWT) directly in your browser. Paste a token to instantly view its header, payload, and signature. We visually verify the token structure and decode Base64Url encoded claims into readable JSON. Crucially, this tool runs 100% client-side, meaning your sensitive auth tokens (Bearer tokens) are never sent to a backend server, ensuring compliance with security best practices.

How it Works

1Paste your JWT string (header.payload.signature).
2The tool splits and decodes the three sections.
3View the Header (algo, typ) and Body (claims, exp, sub) as formatted JSON.
4Check the 'Expiration' time relative to now.
5See raw vs. decoded values side-by-side.

Key Features

Instant decoding of header and payload claims.

Human-readable expiration (exp) and issued-at (iat) timestamps.

Color-coded highlighting of token parts.

Validation of JSON structure.

Privacy-First: Zero transmission of tokens.

Common Use Cases

Auth Debugging: Check if a user's token has expired.Permissions Checks: Verify 'scope' or 'role' claims inside a token.OIDC Testing: Inspect ID tokens returned by Google/Auth0 login flows.Security Audits: Ensure tokens are signed with the expected algorithm (e.g., HS256 vs RS256).Frontend Dev: Debug login state issues without checking network logs.

Frequently Asked Questions

Everything you need to know about using this tool effectively and securely.

Q.Can this tool verify the signature?

We can decode the payload, but verifying the signature requires your private key or secret, which you should NEVER paste into a web tool. Use offline tools or your backend for signature verification.

Related Tools

Enhance your workflow by combining these tools together

JSON Formatter🤝 paired

Inspect decoded claims neatly

Regex Tester🔥 popular

Validate claim patterns