JWT Decoder
Decode and inspect JWT tokens — header, payload, and expiry
Inspect JWT claims without touching production
Authentication bugs are often token bugs — a missing claim, a wrong audience, an expired exp, the wrong algorithm. Decoding a JWT in the browser shows you the header, payload, and expiry instantly without sending the token to any server, so you can debug login, authorization, and API access issues with confidence.
Use the decoder when you need to
Debug an expired or rejected token
Look at the exp, nbf, and iat claims to confirm whether the token is past its lifetime or not yet valid.
Verify the claims your backend expects
Check that the audience, issuer, scopes, and custom claims match what your authorization layer requires.
Audit a token before pasting it into a ticket
Decode the payload to confirm there's nothing sensitive inside before sharing the token in a bug report.
How to decode a JWT quickly
- 1
Paste the JWT (the long string with two dots) into the input field.
- 2
Inspect the decoded header, payload, and expiry status.
- 3
Copy specific claims or the full payload for use in a bug report or test.
Keep going
Decode arbitrary Base64
Use the encoder/decoder when the value isn't a JWT but is still Base64-encoded.
Test an authenticated request
Replay the request that produced the token to verify auth end-to-end.
Format the payload
Beautify the decoded payload before pasting it into another tool.
Validate the payload
Run a syntax check on custom claims if your decoder produced unusual output.
Common JWT debugging workflows
Decode the token to see if the expected claim is missing or the audience is wrong.
Confirm a freshly minted token's expiry matches your auth provider's configured lifetime.
Verify the user has the right scopes before troubleshooting authorization in your code.
Related Tools
Base64 Encode/Decode
Encode and decode Base64 strings in the browser
JSON Formatter
Beautify JSON from APIs, AI tools, and logs with configurable indentation
JSON Validator
Validate API and AI-generated JSON with detailed error messages and line numbers
JSON Viewer
Explore JSON with interactive tree, table, and raw views
Frequently Asked Questions
Paste the full JWT token (the long string with two dots separating three parts) into the input field. The tool instantly decodes the header (algorithm, type) and payload (claims, expiration, issuer) without needing any secret key.
Yes. The decoding happens entirely in your browser using JavaScript — no data is sent to any server. JWTs are encoded (Base64URL), not encrypted, so decoding doesn't require your secret key.
A JWT has three Base64URL-encoded parts separated by dots: the Header (algorithm and token type), the Payload (claims like user ID, expiration, roles), and the Signature (cryptographic proof the token hasn't been tampered with).
Paste your token and look at the exp (expiration) claim in the decoded payload. The tool shows both the raw Unix timestamp and a human-readable date, plus an indicator showing whether the token is currently expired.