Command Palette

Search for a command to run...

JWT Decoder

Decode JSON Web Tokens (JWT) online to inspect headers, claims, and signatures without executing any code.

jwttokendecodevalidate

Formatting Options

Preview the shared config renderer across simple, choice-based, and multi-select settings.
Strip Bearer prefix

Ignore a leading Bearer prefix before decoding the token.

Timestamp display

Control how exp, iat, and nbf claims should be presented.

Show timestamps in the browser's local timezone.
Show signature section

Keep the third JWT segment visible while inspecting tokens.

Overview

A JWT is three Base64url segments—header, payload, signature. Decode jwt online to peel them apart and see the JSON inside. Inspect jwt payload, check header claims, verify expiry without running a full auth stack. Jwt decoder for debugging auth flows, understanding token structure, or validating API tokens. Decode json web token locally; verify signatures in your app.

Features
  • JWT Decoding

    Read token headers and payloads without manual Base64URL work

  • Payload Access

    Inspect claims quickly while debugging auth responses

  • Quick Inspection

    Review token contents before using them in development

  • Privacy First

    All processing happens in your browser

Quick Tips
  • Decode tokens from APIs to verify claims and expiration times
  • Check the payload carefully before assuming a token grants access
  • Do not treat decoding alone as proof that a token is trustworthy
  • All data stays in your browser - nothing is sent to servers

When this tool helps

Practical situations where this tool is worth opening.
  • Inspecting token headers and claims while debugging an authentication issue.
  • Checking expiration, issuer, or audience fields without wiring up app code first.
  • Comparing tokens between staging, local, and production-safe test environments.

Common mistakes to avoid

A few easy ways these workflows go wrong in practice.
  • Treating decoded claims as proof that a token is valid or trusted.
  • Sharing production bearer tokens in tickets, chat, or screenshots.
  • Assuming the algorithm listed in the header is safe without verification.

Worked examples

Short examples that show what this tool is useful for.
Inspect expiration claims
Decode a token to confirm which fields are present before changing auth code.

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE3MDQwNjcyMDB9.signature

Output

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "123",
    "exp": 1704067200
  }
}

Decoding helps with inspection, but signature verification still belongs in your application.

FAQ

Clarifications people often need before using the output.

Related guides

Original reading that explains the workflow around this tool.
Understand what a JWT decoder can and cannot tell you, and avoid treating decoded claims as proof of trust.

5 min read

Similar Tools