JWT Decoder
Decode and inspect JSON Web Tokens - fully client-side
JWT Decoder
What this tool does
Decodes JSON Web Tokens into their three parts - header, payload, and signature - so you can inspect claims, expiration, and algorithm. Runs fully client-side.
Who it's for: Backend developers debugging authentication flows, security engineers auditing token contents, and anyone troubleshooting 401/403 errors in an API.
When to use
- •Inspect an expired JWT to see its exp claim and reissue timing.
- •Verify the algorithm (alg) used by an identity provider.
- •Debug a failed API call by decoding the user's token.
- •Understand which claims (sub, scope, custom fields) your system issues.
How it works
- 1Paste a JWT (three base64 segments separated by dots).
- 2The tool splits it and base64-decodes the header and payload.
- 3Signature is displayed as-is - verifying it requires the issuer's public key.
- 4Nothing is sent anywhere; the token never leaves your browser.
Tips
- •Never paste production JWTs into random online decoders - use a trusted one like this.
- •An expired token still decodes fine; check the exp claim (Unix timestamp).
- •JWT base64 uses URL-safe alphabet (- and _ instead of + and /).