Paste any JSON Web Token and instantly inspect the header, payload claims, and expiry — all decoded locally with nothing sent to a server.
The JWT Decoder parses a JSON Web Token and displays the header, payload, and standard claim explanations in a readable format. It shows an expiry countdown when an exp claim is present and labels each registered claim so you understand what it means. Because decoding happens entirely in the browser, you can safely paste tokens without worrying about them being transmitted anywhere.
No tutorials. No learning curve. Open it and get started.
Runs in your browser. Decoding is done entirely client-side — your JWT is never sent to any server, making it safe to use with real tokens from development or staging environments.
Completely free. No trial period. No premium tier for basic functionality. No account required.
One job, done well. The JWT Decoder was built to solve a specific problem cleanly. No feature bloat, no ads, no distractions — just fast, private token inspection.
Is it safe to paste my JWT into this tool?
Yes. The JWT Decoder runs entirely in your browser — your token is never sent to any server. Decoding is done client-side using JavaScript, so the token stays on your machine.
Does the tool verify the JWT signature?
No — signature verification requires the secret or public key, which you should never share. The tool decodes the header and payload (which are Base64URL-encoded, not encrypted) so you can inspect the claims.
What claims does the tool explain?
The decoder provides human-readable explanations for standard registered claims including iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at), and jti (JWT ID).
How does the expiry countdown work?
If your token contains an exp claim, the decoder calculates the time remaining until expiry based on your device's current time and displays it as a live countdown — useful for debugging session or auth issues.
What JWT algorithms does the decoder support?
The decoder can parse tokens signed with any algorithm (HS256, RS256, ES256, etc.) since it only decodes the header and payload. The algorithm used is shown in the header section of the output.