🔐 Dev

JWT Decoder

Decode and inspect JWT (JSON Web Tokens). View the header, payload and verify expiration. Processed 100% in the browser — the token never leaves your device.

JWT Token

What is a JWT?

A JSON Web Token (JWT) is an open standard, described in RFC 7519, that carries information between parties as a compact JSON object. It breaks into three parts separated by dots: the Header, which holds the algorithm, the Payload, with the data, and the Signature, which is the signature. Keep in mind that, by default, the token isn't encrypted. It's only encoded in Base64URL.

Decode and inspect JWT tokens

The JWT (JSON Web Token) shows up in nearly every API authentication, yet that long Base64-encoded string reveals nothing at a glance. This decoder opens the token and lays out its contents in a readable form, splitting the header from the payload so you see exactly what sits inside.

Beyond showing the claims, it reads the time fields and flags whether the token has already expired. That's precisely what you need when debugging a failing login or a rejected request. The header's algorithm, the payload data and the validity all appear, neatly organised, instead of you decoding Base64 by hand.

Processing is 100% in the browser, so the token never leaves your device or reaches any server. One thing worth remembering: decoding isn't verifying the signature. Anyone can read a JWT's contents, so never store secrets inside one.

Frequently asked questions

What happens if I paste an expired token?

It still decodes in full, and a red banner reports the exact date and time held in the exp claim. That check compares exp against your own device clock, so a machine set to the wrong time will flag a valid token as expired. A token with no exp shows no banner at all, and the nbf and iat claims are displayed but never evaluated.

Why do I get an error saying three parts were expected?

The tool splits the input on dots and needs exactly three segments. An encrypted JWE, which has five, or a truncated copy breaks that count. Leading and trailing spaces are trimmed for you, but if you copied the word Bearer along with the token the count still passes and the failure moves to the Base64URL decode of the header.

Can I edit the payload and produce a new token here?

No. This is a read-only inspector: the third segment, the signature, is neither displayed nor recalculated, and there is no field for a key or a secret. Editing a claim would invalidate the signature anyway, and only the service holding the key can issue a valid token. The buttons copy the header and payload as formatted JSON.

Related Tools

🔓

JWT Decoder Verbose

Decodes the header and payload of a JWT without verifying the signature, explains each registered claim and turns exp, nbf and iat into readable dates.

📦

package.json Generator

Build a minimal package.json: name, version, description, scripts, license, repository, type (module/commonjs). Everything in your browser.

⚖️

JSON Size Analyzer

Analyzes a JSON payload and shows how many bytes each key takes, sorted by weight, with percentage of total and the full path per node.

▲

vercel.json Generator

Create a vercel.json with routes, redirects and HTTP headers ready for your Vercel deploy. Set it all up in the browser and drop it into your repo.

🎮

Discord Embed Builder

Build Discord embeds (title, description, color, fields, footer, thumbnail) and export the JSON ready for webhook. Includes preview. Everything in your browser.

🔑

Authorization Header Parser

Identify the scheme (Basic, Bearer, Digest) of an Authorization header and extract the payload, decoding Basic from base64.