Free JWT Decoder
Inspect any JSON Web Token in one click. Paste a JWT and instantly read its decoded header and payload as formatted JSON — with issued-at and expiry times converted to human dates and an at-a-glance expired badge. Nothing is verified or sent anywhere; it is pure, private decoding.
Decoded token
Header
Payload
Signature
How to Use the JWT Decoder
- Paste your JWT (the three Base64 parts separated by dots).
- The header and payload decode instantly as formatted JSON.
- Check the expiry badge — green for valid, red for expired.
- Copy either section for use in your debugging.
Features
The decoder splits the token, Base64url-decodes the header and payload with proper UTF-8 handling, and pretty-prints both as JSON. Registered claims get special treatment: iat, exp, and nbf are rendered as human-readable UTC dates, and the expiry status is computed live against the current time. Malformed tokens produce specific errors instead of silent garbage.
Benefits & Use Cases
Backend developers inspect tokens their auth server minted to confirm claims and scopes; frontend developers debug “401 Unauthorized” responses by checking what the token actually contains; support engineers read customer tokens without touching production systems. Local decoding means secrets inside tokens stay secret.
Tips
Remember a JWT payload is only Base64url-encoded, not encrypted — anyone holding the token can read it here, so never put sensitive data in claims. This tool decodes only; it does not verify the signature, so do not use it to decide whether a token is trustworthy.
Frequently Asked Questions
What is a JWT?
A JSON Web Token is a compact, URL-safe token with three Base64url-encoded parts — header, payload, and signature — separated by dots. Servers issue them after login so clients can prove their identity on later requests without re-authenticating.
Does decoding a JWT verify its signature?
No. Decoding just reads the (unencrypted) header and payload. Verifying the signature requires the secret or public key and must be done by your server — this tool deliberately does not verify.
Is the JWT payload encrypted?
No. The payload is only Base64url-encoded, which anyone can decode — including with this tool. Never store passwords, personal data, or secrets in JWT claims.
Why does my token show as expired?
The exp claim holds a Unix timestamp. If it is earlier than the current time, the token is expired and servers should reject it. Clock skew between systems can also cause surprising “expired” verdicts.
Is it safe to paste my JWT here?
Decoding happens entirely in your browser — the token is never uploaded. Still, treat tokens like passwords: prefer decoding test tokens, and revoke any production token you paste anywhere.
Related Tools
JWT Generator
Generate unsigned test JWTs instantly with NToolHub’s free tool. Custom header and payload, live decode preview — test-only, private.
Open tool →Base64 Decode
Decode any Base64 string to readable text instantly with NToolHub’s free decoder. Full UTF-8 support and input validation — 100% private, runs in your browser.
Open tool →Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes at once with NToolHub’s free tool. Compare algorithms side by side — private in-browser hashing.
Open tool →Timestamp Converter
Convert Unix timestamps to readable dates and back with NToolHub’s free tool. UTC and local time, auto unit detection — private.
Open tool →Unix Timestamp Converter
Convert Unix timestamps to readable dates and back, with automatic seconds and milliseconds detection built in. Free epoch converter, no sign-up.
Open tool →