JWT Decoder
Decode and inspect JSON Web Tokens instantly in your browser. See header claims, payload fields, expiry status, and timestamps — no server, no signup.
Free JWT Decoder — Inspect Token Claims Instantly
JSON Web Tokens (JWTs) power authentication in virtually every modern web application — from REST APIs and mobile apps to microservices and OAuth 2.0 flows. But JWTs are Base64-URL encoded and unreadable at a glance, making debugging frustrating when a login fails or an API returns 401. Our free JWT decoder solves that instantly: paste your token and see a clean, formatted breakdown of the header (algorithm, token type) and the payload (all claims, with Unix timestamps converted to readable dates).
Unlike jwt.io, our tool runs entirely in your browser with no third-party scripts, no analytics on your token, and no server round-trip. Everything happens client-side via JavaScript's built-in atob() function. It works with all JWT signing algorithms — HS256, RS256, ES256, and more — and immediately flags expired tokens so you know exactly why an API call is being rejected.
How to Decode a JWT Token
- 1
Copy your JWT token
You will typically find your JWT in browser DevTools (Application tab → Local Storage or Cookies), in an API response body, or in a bearer token from an Authorization header.
- 2
Paste into the input box
The token looks like three Base64 strings joined by dots (xxxxx.yyyyy.zzzzz). Paste the entire string. Whitespace is stripped automatically.
- 3
Click "Decode JWT"
The tool splits the token, decodes each part, and renders an interactive claims table. Timestamps for "iat", "exp", and "nbf" are shown as human-readable dates. An expired token is immediately flagged in red.
- 4
Switch between Claims Table and Raw JSON
The Claims Table view gives a clean row-per-field breakdown. Switch to Raw JSON for copy-pasteable output. Copy individual sections (header, payload, signature) with a single click.
Key Features
Full Claims Breakdown
Every field from header and payload shown in a structured table — no scrolling through raw JSON.
Human-Readable Timestamps
"exp", "iat", and "nbf" Unix timestamps are automatically converted to local date/time strings.
Expiry Detection
Instantly shows if a token has expired, with the exact expiry date highlighted in red.
One-Click Copy
Copy header JSON, payload JSON, or the raw signature to clipboard with a single click.
100% Client-Side
Your token is decoded entirely in JavaScript — never sent to any server. Safe for production tokens.
Colour-Coded Token Parts
In Raw JSON view, the three token parts are colour-coded (indigo/violet/gray) for instant readability.
Load Sample JWT
New to JWTs? Load a real sample token to explore the format before decoding your own.
Free & No Login Required
No account, no email, no rate limits. Just paste and decode.
Understanding JWT Structure
Every JWT has exactly three parts separated by dots. Here is what each part contains and what you will see when you decode it:
| Part | Encoded | Contains | Common fields |
|---|---|---|---|
| Header | Base64-URL | Metadata about the token | "alg" (algorithm), "typ" (type) |
| Payload | Base64-URL | Claims — the actual data | "sub", "name", "iat", "exp", "iss", "aud" |
| Signature | Base64-URL | Cryptographic integrity check | HMAC / RSA / ECDSA hash — cannot be faked without the key |
Security note: JWT payloads are Base64-encoded, not encrypted. Anyone with the token can read the claims. Never store sensitive data (passwords, credit card numbers, PII) in a JWT payload. Use HTTPS and short expiry times to limit exposure.
Common Use Cases
Debugging API 401 Errors
Check whether your token is expired, missing required claims, or has the wrong audience ("aud") — all in seconds.
Inspecting Auth Flows
Verify that your auth server is issuing the correct claims (roles, scopes, user ID) during OAuth 2.0 or OIDC flows.
Frontend Development
Quickly read the "sub" or "name" claim from a stored token to display user info — without writing a decoder yourself.
Security Audits
Confirm that tokens use strong algorithms (RS256, ES256) and are not using the insecure "none" algorithm.
QA & Testing
Inspect tokens generated by test fixtures or mocked auth services to ensure they carry the right permissions.
Learning & Onboarding
New to JWTs? Load the sample token and explore the structure — a great hands-on intro to the RFC 7519 spec.
Frequently Asked Questions
🚀Share this tool with friends!
Help others discover this free tool. Share on your favorite platform!
💡 Did you know? QuickToolkit is 100% free, with no ads or signup required!