JWT Decoder — Read the Payload, Check the Claims
Decode a JWT to inspect its header, payload claims, and expiry — plus signature verification with your secret or public key. Local only, nothing logged.
A JWT looks like noise, but it is just base64url-encoded JSON: header, payload, signature. Pasting one here decodes it instantly — every claim becomes readable: subject, issuer, audience, issued-at, and most importantly exp, the expiry that explains "why did my session die."
It also verifies signatures when you provide the secret (HS256) or public key (RS256/ES256) — the step that distinguishes a valid token from a forged one. Decoding is local; tokens from production systems are never transmitted anywhere.
100% in-browser · no upload · no signup · nothing you paste or drop here leaves your device
JWT Decoder / Debugger
Decode JWT header and payload locally. No token leaves your browser.
⚠️ Decoding runs 100% locally in your browser — your JWT is never uploaded. Never paste production access tokens or sensitive credentials into any online tool. This decoder only reads the header and payload; it does NOT verify signatures and must not be used to trust token contents.
What a JSON Web Token actually is — illustrated
A JWT (RFC 7519) is a compact, URL-safe string of three dot-separated segments: a header that names the signing algorithm, a payload of claims about the user, and a signature that cryptographically binds the two. Each segment is JSON that has been Base64URL-encoded (URL-safe base64 with the padding stripped). This decoder reads the first two segments locally and checks the exp claim against the current time — it never verifies the signature, because that requires the server's secret key.
Left: the two JSON segments are Base64URL-encoded so the token survives URLs, cookies and Authorization headers. Right: the signature is HMAC-SHA256 (or RSA/ECDSA) computed over the encoded header.payload with a secret only the server holds — that is what proves the token was not tampered with.
Maya, a backend engineer, gets a 401 Unauthorized from an API. She pastes the token from the Authorization header into this decoder to see exactly what the server was complaining about.
- Paste the token:All three segments arrive as one string, straight from the 401 response
- Header reads:{"alg":"HS256","typ":"JWT"} — so the server signs with HMAC-SHA256
- Payload claims:sub: user 1234, iat: issued-at, exp: expiry — decoder shows EXPIRED when exp is in the past
- Signature caveat:Verification needs the secret key, so decoding only inspects — it never trusts — the claims
About this decode JWT token
This page covers jwt parser online, read jwt payload claims, jwt expiry check, verify jwt signature online — all the same underlying task as decode JWT token. The tool above is FreeToolHub's jwt decoder embedded in full: every feature works right here, and nothing you process is uploaded to any server.
Frequently asked questions
How do I decode a JWT without a library?
Split the token on dots, base64url-decode the first two segments, and you get JSON: the header (algorithm, type) and payload (claims). The signature is the third segment — it cannot be "decoded", only verified against a key. This tool does the decoding and optional verification without you touching a console.
Is it safe to paste a JWT here?
The tool runs entirely in your browser — no network calls, no logging. Still, a decoded JWT's payload was never a secret (anyone holding the token can decode it); the signature is what makes it trustworthy. Do paste production tokens to debug exp/aud issues — just never treat decoding as validation without the signature check.