Free JWT Decoder

JSON Web Tokens carry your identity between services — but what's actually inside yours? The JWT Decoder splits any token into header, payload, and signature, pretty-prints the claims with syntax highlighting, and analyzes time claims: issued-at, not-before, and expiry with human-readable countdowns. It also flags the dangerous alg:none case so unsigned tokens never slip through unnoticed.

Only decode tokens you own. JWT payloads are merely Base64-encoded — anyone can read them. Never paste a production token into an untrusted site (this page is 100% local, but the habit matters).
Private by design. This tool runs 100% in your browser — pasted tokens are decoded locally and never uploaded or stored anywhere.

How to Use the JWT Decoder

  1. Paste a JWT into the box (or try the sample).
  2. Click Decode token to see the header and payload, pretty-printed.
  3. Check the expiry analysis — expired, valid, or not-yet-valid.
  4. Note the signature status: decoding never verifies a signature.

Features

Header/payload pretty-printing with syntax highlighting; expiry and nbf analysis with relative times; alg:none detection; signature presence status; sample token; claim summary.

Benefits & Use Cases

Debug authentication flows, verify token contents during development, check expiry without writing code, or audit tokens for missing claims.

Tips

Decoding is not verifying — this tool cannot check signatures, which require the secret or public key. Never paste production tokens into any website as a habit, even local-first ones; use test tokens for debugging.

Frequently Asked Questions

Is it safe to paste my JWT here?

The page runs entirely locally — nothing is uploaded. Still, build the habit of only debugging with test tokens, since JWT payloads are readable by anyone who holds them.

Does decoding verify the signature?

No. Decoding only reveals the contents. Signature verification needs the secret (HMAC) or public key (RSA/ECDSA) and must happen on your server.

What does "alg: none" mean?

The token is unsigned — anyone can forge it. Servers must reject alg:none tokens; if yours accepts them, that is a critical vulnerability.

Why is my token expired?

Its exp claim is in the past. Tokens are short-lived by design — request a fresh one via your login or refresh flow.

Can I see the signature?

Yes, it is displayed — but as opaque Base64. Its value only matters to the verifier holding the key.

Related Tools

JWT Generator

Generate unsigned test JWTs instantly with NToolHub’s free tool. Custom header and payload, live decode preview — test-only, private.

Open tool →

Base64 Decoder

Decode Base64 to text free with NToolHub. Handles standard and URL-safe Base64 with full Unicode support — 100% in your browser, nothing uploaded.

Open tool →

Base64 Encoder

Encode text or files to Base64 free with NToolHub. Unicode-safe with URL-safe output and MIME line-wrap options — runs 100% in your browser.

Open tool →

Hash Generator

Generate MD5, SHA-1, SHA-256 and SHA-512 hashes at once with NToolHub’s free tool. Compare algorithms side by side — private in-browser hashing.

Open tool →

Basic Auth Generator

Build HTTP Basic Auth headers free with NToolHub. Base64 credentials with a ready curl example — Unicode-safe, 100% in your browser, nothing uploaded.

Open tool →