JWT Decoder
JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a compact JSON object. A token consists of three parts separated by dots: Header (signing algorithm), Payload (data claims), and Signature.
How JWT Works Header and Payload are encoded in base64url and are not encrypted — anyone can read them. The Signature is created from the Header, Payload, and a secret key, allowing token authenticity verification. JWT is widely used for authentication in web applications (OAuth 2.0, OpenID Connect) and inter-service authorization in microservice architectures.
Header
Payload
Timestamps
Signature
Free online JWT (JSON Web Token) decoder. JWT is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. A token consists of three parts separated by dots: Header, Payload, and Signature.
Paste a token and instantly see its contents: the header with signing algorithm information (HS256, RS256, etc.), the payload with user data (claims), and the signature. The tool automatically decodes base64url encoding and formats JSON for easy reading. For tokens with an exp field, expiration status is shown — already expired or remaining time in hours and minutes. The iat field is displayed as a human-readable issue date.
All computations are performed locally in the browser — your token is never transmitted or stored. An essential tool for developers working with OAuth 2.0, OpenID Connect, authentication, and JWT-based authorization in web applications and microservices.
How to use it
- Paste the whole token — three parts separated by dots: header.payload.signature.
- The decoder shows the header (signing algorithm and type), the payload (claims such as sub, iss, aud, exp, iat and custom fields) and the signature.
- exp, iat and nbf are converted to readable dates and an expired token is flagged immediately.
When it helps
- Debugging authorization: understand why an API answers 401 — the token expired, the aud is wrong or a required role is missing.
- OAuth 2.0 and OpenID Connect integration: see which claims a provider (Google, Keycloak, Auth0) issues.
- Learning: see exactly what is inside a JWT and why it must not be stored in the open.
Frequently asked questions
Does the tool verify the signature?
No. Verification needs the issuer’s secret or public key. The decoder shows the contents; the server that accepts the token must check the signature.
Is it safe to paste a token here?
Decoding runs in the browser and the token is not sent anywhere. Still, for long-lived production tokens prefer test values.
Why can the payload be read without a password?
A JWT is signed by default, not encrypted: base64url is encoding, not encryption. Do not put secrets in a token; JWE exists for that.