Decode JWT header and payload locally. No token leaves your browser.
⚠️ Decoding runs 100% locally in your browser — your JWT is never uploaded. Never paste production access tokens or sensitive credentials into any online tool. This decoder only reads the header and payload; it does NOT verify signatures and must not be used to trust token contents.
A JWT (RFC 7519) is a compact, URL-safe string of three dot-separated segments: a header that names the signing algorithm, a payload of claims about the user, and a signature that cryptographically binds the two. Each segment is JSON that has been Base64URL-encoded (URL-safe base64 with the padding stripped). This decoder reads the first two segments locally and checks the exp claim against the current time — it never verifies the signature, because that requires the server's secret key.
Left: the two JSON segments are Base64URL-encoded so the token survives URLs, cookies and Authorization headers. Right: the signature is HMAC-SHA256 (or RSA/ECDSA) computed over the encoded header.payload with a secret only the server holds — that is what proves the token was not tampered with.
Maya, a backend engineer, gets a 401 Unauthorized from an API. She pastes the token from the Authorization header into this decoder to see exactly what the server was complaining about.
A JWT has three parts: header.payload.signature. Paste your JWT to decode the base64 header and payload, check expiry, and inspect claims — all locally in your browser.
FreeToolHub JWT Decoder is a free browser-based tool that decodes JWT tokens to inspect header and payload, no signup, no upload.
Decode and debug JWT tokens locally. No tracking, no server, 100% in-browser. Free.
The JWT Decoder splits any JSON Web Token into its three dot-separated parts and renders each in readable form: the header showing the algorithm and key ID, the payload with all claims decoded, and the signature section. Beyond plain decoding it runs practical checks developers actually need — algorithm detection across HS256, HS512, RS256, ES256, and more, an expiration countdown converting the exp and iat numeric dates into human timestamps, and instant flagging of expired, not-yet-valid, or suspiciously malformed tokens. Everything decodes locally in your browser, which matters because JWTs are credentials: pasting one into a random web service is the same as handing over a session key.
Backend developers debugging authentication inspect what claims an identity provider actually emitted — roles, scopes, tenants — instead of what the docs promised. Frontend engineers tracing why a user got logged out check exp timing against clock skew. API integrators verifying webhook and OAuth tokens confirm the right audience and issuer before filing support tickets. Security learners study real token structure safely, and anyone reviewing a token before pasting it into logs can strip or inspect sensitive claims first.
(1) Paste the token — the tool auto-detects the JWT shape and splits on the dots. (2) The header decodes from base64url, revealing alg, typ, and kid fields. (3) The payload decodes with every standard claim annotated: sub, iss, aud, exp, iat, nbf, plus custom claims rendered as-is. (4) Timestamps convert to your local timezone with a live countdown; expired tokens turn red with the elapsed time since expiry. The signature segment is shown but not verified, since verification requires the secret or public key, which should never be pasted into web tools.
The payload's registered claims carry the semantics: sub identifies the subject, usually the user ID; iss is the issuer, the auth server that minted the token; aud lists intended recipients and is what APIs check to reject foreign tokens; exp and nbf bound the validity window, and iat records mint time. Beyond these, providers add their own — roles, permissions, email_verified, tenant — and reading them is often the fastest way to debug authorization logic. One security note that shapes how you treat any decoded token: decoding is not verifying. The payload is base64, not encryption, so anyone can read or forge claims; only the signature, checked against the secret by your backend, proves authenticity. That is why this tool decodes locally and never asks for keys.
A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It consists of three Base64URL-encoded parts separated by dots: header.payload.signature. JWTs are widely used for authentication and information exchange — when you log into a web app, the server typically returns a JWT that your browser sends with every subsequent request to prove your identity.
No. The JWT Decoder processes your token entirely in your browser using JavaScript Base64 decoding. Your token — including any session secrets, user IDs, or PII in the payload — never leaves your device. This is critical for security: unlike jwt.io and similar online decoders, you can safely debug production tokens here.
The header typically contains two fields: "alg" (the signing algorithm, such as HS256, RS256, ES256, or HS384) and "typ" (the token type, always "JWT"). The algorithm tells you how the signature was created — HS256 means a shared secret, RS256 means an RSA private key. Mismatched algorithms between header and actual signing indicate a potential security issue.
The payload contains an "exp" claim (expiration time) as a Unix timestamp in seconds. The decoder converts this to a human-readable date and compares it to the current time. If the token is expired, a red "EXPIRED" badge appears. The payload may also contain "iat" (issued at) and "nbf" (not before) timestamps for full lifecycle validation.
The tool decodes and displays the signature but does not cryptographically verify it — verification requires the secret key (for HMAC) or public key (for RSA/ECDSA), which only the issuing server possesses. However, the tool flags suspicious conditions: weak algorithms (none, HS256 with short keys), expired tokens, and missing required claims.
Yes. Decoding a JWT only base64-parses the header and payload sections—it does not transmit your token anywhere. Processing runs entirely in JavaScript on your local machine with zero network requests. Unlike jwt.io (which loads third-party analytics), this tool has no tracking, no cookies, and no external dependencies.
It decodes and displays the header (algorithm, type), payload (claims, expiration, issuer), and signature. For HS256 tokens, you can paste the secret to verify signature integrity locally. It supports RS256, ES256, and HS256 algorithms—the three most common in production OAuth 2.0 and OpenID Connect implementations.
This tool is also known by these tasks — each link opens the same tool with a focused guide:
What do you call a crab that plays baseball?
No paywalls, no signups, no data sold. Built by a solo developer who believes useful tools should be accessible to everyone.
☕Support me on Ko-fi— keep tools free100% of proceeds go towards hosting & building more free tools.