JWT Decoder
Inspect JSON Web Tokens instantly. View header, payload claims, expiry, and algorithm — your token stays in your browser and is never transmitted anywhere.
Your token is decoded entirely in this browser tab — it is never transmitted to any server. Safe to paste production tokens containing user data.
Token never leaves your browser — decoding runs locally in JavaScript.
What Can You Do With This Tool?
Debug API Authentication
When a request returns 401 Unauthorized, paste the Bearer token to inspect the claims. Check whether the sub matches the expected user, whether roles or scopes include the required permission, and whether the exp timestamp is still in the future.
Inspect OAuth & OIDC Tokens
Google, GitHub, and Auth0 all return JWTs in their OAuth flows. Paste the id_token or access_token to see exactly which claims your identity provider is issuing — without leaving the page or sharing the token with a third-party service.
Verify Claims During Development
After writing a token-generation function, paste the output here to confirm that the alg, iss, aud, and custom claims match your spec before writing tests. Instantly see exp and iat as human-readable dates.
Check Token Expiry
The exp claim shows exactly when a token becomes invalid. This tool displays it both as an absolute UTC timestamp and as a relative time ("expires in 2 hours") so you can quickly spot short-lived tokens or tokens that have already expired.
Frequently Asked Questions
Is it safe to paste a production JWT here?
Yes. The decoder runs entirely inside your browser — your token is never sent to any server. You can confirm this by watching network requests in your browser's developer tools while pasting. The tool works completely offline once the page loads.
Does this verify the signature?
No. Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/EC algorithms like RS256, ES256). This tool only decodes the base64url-encoded header and payload, which is all that's needed for inspection. Verification should happen server-side.
What are the three parts of a JWT?
A JWT is three base64url-encoded strings joined by dots: Header.Payload.Signature. The header specifies the algorithm and token type. The payload contains the claims (user data and metadata). The signature is a cryptographic hash of the first two parts using a secret or private key.
What are the standard JWT claims?
The JWT specification defines seven registered claims: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). Applications can add any additional claims they need.
What does "no expiry claim" mean?
Some JWTs intentionally omit the exp claim. This means the token does not expire on its own — the application must handle revocation through other means (e.g. a token denylist or short-lived refresh cycles). This is valid but generally not recommended for access tokens.
Can I decode tokens from any provider?
Yes — JWT is a standard (RFC 7519) used by Google, GitHub, Auth0, AWS Cognito, Azure AD, Stripe, Clerk, and most other identity and API platforms. As long as the token follows the three-part dot-separated format, this tool can decode it.
More Productivity Tools
Explore our other privacy-focused tools designed to boost your productivity
Base64 Encoder & Decoder
Encode text or files to Base64, generate data URIs, CSS url(), HTML img tags, and URL-safe Base64 — no uploads
JSON Formatter & Validator
Format, validate, and explore JSON & XML in your browser — tree view, table view, sort keys, no uploads
UTM Link Builder
Build UTM-tagged campaign URLs instantly — source, medium, campaign presets, custom params, one-click copy. No uploads.