JWT Decoder Online
Paste a JSON Web Token to decode the header and payload, inspect claims, and understand what is inside the token without uploading it.
Why add a JWT decoder page?
The CSV showed demand around jwt decode, jwt-decode, jwt token decoder, and json web signature decode. This page gives those searches a dedicated, useful landing page instead of forcing them onto a generic JSON formatter. A JWT has its own structure, claims, timestamps, and security language, so a focused page is a better match for developer intent.
Decode is not verify
A JWT decoder reads the base64url-encoded header and payload. It does not prove the token is valid, not expired, or trusted. Signature verification requires the correct secret or public key and must happen in your application, API gateway, authentication provider, or server-side security workflow.
This distinction matters because the decoded text can look legitimate even when the signature is wrong. Anyone can create a token-shaped string with a header and payload. Verification is the step that proves the token was signed by the expected issuer and has not been changed. Use this page for inspection and debugging, not for access-control decisions.
What to inspect
Check the algorithm, token type, subject, issuer, audience, issued-at time, not-before time, expiration time, and any custom claims your application expects. If the token is failing in a test environment, compare the audience and issuer against the values configured in the service that receives the request. A mismatch there is a common reason a token decodes correctly but still fails authorization.
When reviewing timestamps, remember that JWT time claims are usually Unix timestamps in seconds. Local time zones, server clock drift, and short token lifetimes can make an otherwise valid login appear broken. If a token is already expired, generate a fresh sample before continuing the debugging session.
Safe debugging workflow
If you are debugging authentication, use test tokens whenever possible. Remove secrets from screenshots, avoid sharing production bearer tokens in tickets, and never paste live customer credentials into public examples. The decoder runs locally in the browser, but your clipboard, screenshots, chat tools, and issue trackers can still expose sensitive values after the page has done its work.
FAQ
Does this verify a JWT signature?
No. It decodes the token so you can read the header and payload. It does not verify the signature.
Is the token uploaded?
No. The decoding runs in your browser after the page loads.
What does exp mean in a JWT?
The exp claim is the expiration time as a Unix timestamp in seconds.