API URL Kit
Encoding & Crypto Runs in your browser

JWT Decoder — Inspect Token Claims Locally

Decode a JSON Web Token to read its header, payload and claims — including expiry, issuer and audience — entirely in your browser. The token is never uploaded, logged or transmitted, so you can safely inspect a live bearer token while you debug an auth flow.

Never leaves your browser Decodes as you type Expiry in local time

Payload

 
 
 
Claims
 
 
 
 
Header
 
 
 
 
Signature
 

Shown as-is. Verifying a signature requires the issuer’s secret or public key, so it
      is a server-side check — this tool decodes, it does not verify.

 
 
 
  

What JWT Decoder does

Your token is never transmitted
Decoding runs in JavaScript on this page. There is no upload, no request and no server log — which matters, because a live bearer token pasted into a hosted decoder is a credential handed to a stranger.
Expiry answered immediately
The exp, iat and nbf claims are Unix timestamps, which tell you nothing at a glance. They are converted to your local time with a plain-language summary such as Expired 4 minutes ago.
Registered claims explained
Standard RFC 7519 claims — iss, sub, aud, jti and the rest — are annotated with what they mean, so you are not switching to the spec to remember which is the audience.
Masking for screen sharing
Identity claims such as sub and email are masked by default, so you can screenshot or share a decoded token without leaking who it belongs to. Copy still yields the real payload.

Supported formats


The tool reads raw text, so whatever your stack produces will work.

JWTJWS Compact SerializationBearer tokenOAuth 2.0 access tokenOIDC ID token

How it works

  1. Paste the token
    Drop in the JWT from your request header, cookie or auth response. A Bearer  prefix is fine — it is stripped for you.
  2. Read the decoded output
    The header and payload are decoded and pretty-printed as you type, with the expiry status shown above them.
  3. Check the claims that matter
    Scan the claims table for expiry, issuer and audience, and copy any single value you need to paste elsewhere.

Cheatsheet

The tokens you reach for most, at a glance.
issIssuer — who created and signed the token
subSubject — who the token is about, usually a user ID
audAudience — the recipient the token is intended for
expExpiration time — reject on or after this moment
nbfNot before — reject before this moment
iatIssued at — when the token was created
jtiJWT ID — unique identifier, used to prevent replay
algAlgorithm used to sign, e.g. HS256 or RS256
kidKey ID — which key from the issuer's key set signed it
scopePermissions granted, space-separated

How people use it

Debugging a 401
The fastest way to tell an expired token from a wrong audience or a missing scope is to look at the claims the API is rejecting.
Comparing two environments
Decode the token your staging and production issuers hand out and compare the claim sets when one works and the other does not.
Reviewing what a token exposes
A JWT payload is only base64url — not encrypted. Decoding your own tokens shows exactly what any holder can read.
Frequently asked questions
Is it safe to paste a real token?
Decoding happens entirely in your browser with no network request, so the token is never transmitted. Even so, treat any live token as a credential: prefer an expired or test token where you can, and rotate anything you have pasted into a tool you do not control.
Does this verify the signature?
No. Decoding shows you what a token contains; verifying a signature requires the issuer's shared secret or public key and is a server-side concern. A decoded payload tells you what the token claims, not that the claim is trustworthy.
Why can I read the payload without a key?
A JWT payload is base64url-encoded, not encrypted. Anyone holding the token can read every claim in it. The signature protects against modification, not against reading — so never put a secret in a JWT payload.
What does "alg: none" mean?
It marks an unsecured token with no signature at all. Some libraries have historically accepted these by default, which lets an attacker forge any payload. If you see it on a token your API accepts, treat it as a vulnerability.
The exp claim looks like a random number.
It is a Unix timestamp — seconds since 1 January 1970 UTC. It is converted to your local time here, and you can convert arbitrary values with the Timestamp Converter.
Can I decode a token that is not a JWT?
Only if it has the three dot-separated base64url segments a JWT requires. Opaque tokens and session IDs carry no readable structure — there is nothing to decode.
 

Last updated 2026-08-22