How to use
01
Paste your token
Drop the full JWT into the input box, all three dot-separated segments. The header and payload decode instantly as you type, no button needed.
02
Read the header and payload
The Header section shows the signing algorithm and token type, while the Payload section lists every claim. Each section has its own copy button for grabbing the JSON.
03
Check the expiry alert
If the payload contains an exp claim, the tool converts it to a readable date and shows a warning banner when the token has already expired.
Why JWT Decoder
- 100% client-side. Your tokens never leave your browser.
- Reveals header, payload, and signature parts.
- Highlights expired tokens via the exp claim.
Common questions
Does this JWT decoder verify the signature?
No, it only decodes. Verifying a signature requires the secret or public key the server signed with, so verification belongs in a server-side library. The third segment is displayed but never validated here.
Is it safe to paste a real token into this page?
Yes. Decoding happens with JavaScript in your browser, and the token is never transmitted or stored. Still, treat production tokens like passwords and rotate any you've shared in chat or a bug report.
Why does my token fail to decode?
The most common cause is a partial paste. A JWT needs at least two dot-separated parts, and each part must be valid base64url. Whitespace or a trailing quote copied from a log line will also break parsing.
What do the exp and iat claims actually mean?
Both are Unix timestamps in seconds. iat records when the token was issued and exp marks the moment it stops being valid. This jwt token viewer converts exp to a readable date so you don't have to do the math.
Can I decode a JWT that's missing its signature?
Yes. The tool only needs the header and payload segments, so a token with two parts still decodes. That helps when a logging pipeline has truncated the signature.
How is a jwt parser online different from decoding in code?
It's the same base64url decoding you'd do with a library, just with zero setup. For quick debugging a browser tool is faster; for anything automated, use a maintained JWT library in your language.
Will editing the decoded payload change my token?
No. Decoding is read-only, and changing a claim would invalidate the signature anyway. If you need a token with different claims, request a fresh one from the issuing server.
Is this a free jwt decoder online for chasing 401s?
Yes. Paste a token and it splits the parts and shows the header and payload as formatted JSON right away, entirely in your browser. It is built for reading claims while you debug an auth failure, not for minting new tokens.
What does it take to decode a JSON Web Token here?
Just paste it. The tool splits the dot-separated token, base64url-decodes the header and payload, and prints both with a copy button each. Since it runs locally, you can decode json web token values pulled from request logs without them leaving the tab.
Can I verify a JWT signature online on this page?
No. Verifying checks the signature against the secret or public key, and putting that key into a web page would expose it. The tool decodes but will not verify jwt token online, so hand that step to a server-side JWT library that holds the key.