What is JWT Decoder?
Free online JWT decoder. Parse JSON Web Token headers, payloads, and signatures. Auto-decode Base64 content, show expiry and issued-at times in real time. All decoding happens locally — tokens are never uploaded.
Use Cases
- ◆Token debugging
- ◆API auth troubleshooting
- ◆JWT learning
- ◆Security auditing
How to Use
- 1Paste JWT token
- 2Auto-decode all three parts
- 3View payload and expiry
- 4Copy needed fields
Features
- ✓Three-part parsing
- ✓Auto Base64 decode
- ✓Expiry check
- ✓Browser-based
FAQ
What is the difference between JWT and JWE?
JWT is encoded (not encrypted) — anyone can decode it. JWE is encrypted and requires a key to read.
Is my token uploaded?
No, all decoding happens locally in your browser.
What JWT algorithms are supported?
HS256, RS256, ES256, and 6 other common algorithms. The decoder auto-detects the algorithm from the header.
Can I check token expiration?
Yes. The exp (expiration) and iat (issued at) claims are decoded and displayed as human-readable dates.
Does it validate signatures?
No — it decodes and displays. Signature validation requires the secret/public key, which you should do server-side.
What if the token is expired?
The decoder still shows all fields. The exp date is highlighted so you can see it has passed.