JWT Decoder
Decode JSON Web Token (JWT) header, payload, and signature online for free. All decoding happens locally — your token never leaves your browser.
JWT Token
What is a JWT and how does it work?
A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64URL-encoded parts separated by dots: a header, a payload and a signature. The header declares the signing algorithm, the payload carries claims such as the subject (sub), issued-at (iat) and expiry (exp), and the signature lets the recipient verify the token was not tampered with. This decoder splits the token and pretty-prints the header and payload so you can inspect exactly what a service is sending.
Decode a JWT safely (client-side only)
Everything here runs in your browser. The token you paste never leaves your machine, which matters because JWTs frequently carry session identifiers, user IDs and OAuth scopes. Decoding is not the same as verifying: anyone can read a JWT payload, so never store secrets inside it. The signature is shown but cannot be validated without the signing key.
Reading the exp, iat and nbf claims
The exp (expiration) and iat (issued-at) claims are Unix timestamps in seconds. This tool converts them to human-readable dates and flags whether the token is expired, which is the fastest way to debug a 401 caused by an expired access token. The nbf (not-before) claim works the same way and rejects a token that is used too early.
Common JWT errors and how to fix them
An invalid signature error usually means the wrong secret or a rotated key; token expired means you need to refresh it through your auth flow; malformed token means it does not have exactly three dot-separated parts. When debugging microservice auth, decode the token on both the issuer and consumer side to confirm the algorithm and audience (aud) match. For background on securing service-to-service calls see our Kubernetes security best practices guide.
Frequently asked questions
Is it safe to paste a JWT into this decoder?
Yes. Decoding happens entirely client-side in your browser using JavaScript. The token is never sent to our servers or any third party, so even tokens containing sensitive claims stay on your machine.
Can this tool verify a JWT signature?
No. Verifying a signature requires the secret or public key that signed the token, which you should never paste into a web tool. This decoder only reads the header and payload; verification must happen server-side with your key.
Why is my JWT showing as expired?
The exp claim is a Unix timestamp in seconds. If it is earlier than the current time the token is expired and most APIs will return 401. Request a new token through your refresh or login flow.
What does the alg field in the header mean?
alg tells you how the token was signed, for example HS256 (HMAC with SHA-256) or RS256 (RSA with SHA-256). HS256 uses a shared secret while RS256 uses a private/public key pair. The consumer must use the matching algorithm to verify.