JWT Decode — Decode JWT Token Online Free

What is the JWT Decoder?

JWT decode — paste any JSON Web Token to instantly decode and inspect its header, payload claims, and signature segment, all within your browser without sending your token to any server. This free tool parses JWTs and displays their contents as readable, formatted JSON. A JWT is a three-part encoded string, separated by periods: the Header (which specifies the signing algorithm), the Payload (which contains the claims — user ID, role, permissions, expiry time), and the Signature (which verifies the token’s integrity). This tool decodes and displays all three parts so you can inspect what the token actually contains.

JWTs are at the center of most modern authentication systems — OAuth 2.0, OpenID Connect, and custom authentication middleware all produce JWTs. When debugging authentication failures, permission errors, or session expiry issues, the first step is always to inspect the token’s payload to verify that the correct claims are present and that the expiry time has not passed. Doing this inspection locally, in your browser, is critical: a JWT from a production system contains active session credentials, and pasting it into a random online decoder hands those credentials to an unknown third party.

This tool decodes the Base64Url-encoded Header and Payload segments using JavaScript’s standard string operations and atob() function — the same approach used by jwt.io, but running locally in your browser with no network request made for your token data.

How to Use the JWT Decoder

1. Paste your encoded JWT (the long string with two periods separating the three segments) into the input panel. The token might look like: eyJhbGci...eyJ1c2Vy...SIGNATURE.
2. The tool automatically splits the token at the period characters and identifies the three segments: Header, Payload, and Signature.
3. The Header and Payload are decoded from Base64Url encoding and parsed as JSON. The formatted JSON output appears in the right panel, with both the header claims and the payload claims displayed clearly.
4. Review the key claims in the payload: check the exp field (expiry as a Unix timestamp) to see when the token expires, the sub or user_id to confirm which user the token represents, and any role or permission claims to debug authorization issues.
5. The Signature segment is displayed but not verified — signature verification requires the signing secret or public key, which should remain server-side. Use our Unix Timestamp Converter to convert the exp timestamp to a human-readable date.

Common Use Cases

Debugging authentication failures: When a user reports that they cannot access a protected resource, the JWT they are sending is the first thing to check. Paste their token here to verify it has not expired (check exp), that it is scoped to the correct audience (aud), and that the role or permission claims (role, permissions, scope) include what the resource requires. This is faster than adding server-side logging and redeploying.

Verifying token claims during development: When building a new authentication flow or integrating a new identity provider (Auth0, Cognito, Firebase Auth, Keycloak), you need to verify that the tokens being issued contain the correct claims. Paste a test token here after each configuration change to immediately confirm the claims are correct without writing a decoding script.

Inspecting third-party OAuth tokens: When integrating with third-party services via OAuth 2.0, the access tokens you receive are often JWTs. Decoding them shows you what scopes and claims the provider has included, which helps you understand what API operations the token authorizes and diagnose access errors.

API testing and integration debugging: Tools like Postman, Insomnia, and curl often display JWT tokens in authentication headers. When building an API client or testing an authenticated endpoint, paste the token from your request headers here to confirm it is structurally valid, not expired, and contains the expected user identity before investigating server-side errors.

Security audits and code review: During security audits, reviewing the claims present in JWTs issued by your authentication system helps identify over-provisioning (tokens carrying more permissions than needed), long expiry times that create risk, or missing audience (aud) restrictions that could allow token replay across services.

How Browser-Only Processing Works for This Tool

A JWT’s first two segments (Header and Payload) are encoded using Base64Url — a variant of Base64 that replaces + with - and / with _, and omits = padding. To decode them, this tool reverses that transformation: it restores the standard Base64 characters, adds padding if needed, and calls the browser’s native atob() function to decode the Base64 string to a UTF-8 string. That string is then parsed with JSON.parse() to produce a JavaScript object, which is then formatted with JSON.stringify() for display.

The entire process runs in your browser’s JavaScript engine. The token you paste never leaves your browser — no network request is made, no analytics service receives your token, and no server logs it. You can confirm this by opening DevTools (F12), going to the Network tab, and pasting a JWT while watching the request log. You will see no outbound requests carrying your token data.