What is the jwt decoder?
The JWT Decoder inspects any JSON Web Token, showing color-coded header, payload and signature, with human-readable issued-at and expiry times. It can optionally verify an HS256 signature locally against your secret. Free and 100% in-browser, your token never leaves your device, safe for live or production JWTs.
A JSON Web Token (JWT) packs three Base64URL-encoded parts (a header, a payload of claims, and a signature) into one compact string that services pass around for authentication and authorization. This JWT Decoder splits the token and pretty-prints the header and payload as formatted JSON, then translates the time-based claims (iat, exp, nbf) into readable dates and a live 'valid for' or 'expired' badge, so you can debug an auth flow at a glance. Because a decoded token is just data, anyone can read it, signature verification is separate and opt-in: paste your HS256 secret and the tool re-computes the HMAC with the Web Crypto API right in your browser to confirm the token is genuine. Every byte stays on your machine. There is no server round-trip, no logging, and no account, which matters because tokens often carry live session credentials you should never paste into a website that phones home.
- Difficulty:
- Easy
- Typical time:
- ~15s
- Processing:
- 100% browser processing
Last updated
How to use the jwt decoder
- 1
Paste your token
Drop a JWT into the input. Paste it, drag a.txt/.jwt file onto the pane, or load the sample token to see how it works. Decoding starts instantly.
- 2
Read the three parts
The header shows the algorithm and type, the payload lists every claim as formatted JSON, and the signature is shown raw. Time claims are expanded into readable dates automatically.
- 3
Check the status
Glance at the validity badge to see whether the token is active or expired and exactly how long it has left, plus its issued-at and not-before times.
- 4
Verify the signature (optional)
For an HS256 token, expand the verifier, type your shared secret, and confirm whether the signature is valid, computed locally with Web Crypto.
- 5
Copy or share
Copy the header, payload or full decoded output with one click, or generate a share link that reopens the exact token you're inspecting.
What JWT Decoder includes
Three color-coded panes
Header, payload and signature are split into distinct, syntax-tinted panels (exactly like jwt.io) so the structure of the token is obvious at a glance and each part is copyable on its own.
Human-readable timestamps
The iat, exp and nbf claims are decoded from raw epoch seconds into full local and UTC dates plus a relative phrase like 'expires in 42 minutes', so you never have to convert Unix time by hand.
Live expiry & validity badge
A prominent status pill shows whether the token is valid, not-yet-valid, or already expired, recomputed against the current time the moment you paste, with the exact seconds remaining.
Optional HS256 verification
Drop in your shared secret and the tool re-signs the header and payload with HMAC-SHA256 via Web Crypto to confirm the signature matches, a genuine cryptographic check, done locally.
Nothing leaves your browser
Decoding and verification run 100% client-side. Your token and secret are never transmitted, stored or logged, which is essential when the token is a live session credential.
Instant, keyboard-first
Decoding is live as you type or paste. No submit button. Drag a.jwt/.txt file in, paste from the clipboard, copy any part, share a deep link, and drive it all from the keyboard.
Why use our jwt decoder
Debug auth flows in seconds
Stop squinting at opaque token strings. See the issuer, subject, scopes and audience in clean JSON and immediately spot a missing claim, a wrong 'aud', or a token that expired minutes ago.
Safe for real credentials
Unlike most online decoders, this one never sends your token anywhere. That means you can safely inspect production access tokens without leaking a live session to a third-party server.
Honest about what decoding proves
Decoding is not verification. Anyone can read a JWT's claims. We make that distinction explicit and give you a real, local signature check so you know when a token is actually authentic.
No sign-up, no limits
It's a single web page. Decode as many tokens as you like on any device, with no daily cap, no watermark and no account wall between you and the answer.
Built for the way you work
From quick one-off fixes to daily workflows, see how people put this tool to use.
- Backend developers
Inspect API access tokens
Confirm the scopes, audience and expiry your identity provider is minting, and reproduce a '401' by spotting a stale 'exp': without pasting a live token into an untrusted site.
- Frontend & mobile engineers
Debug login and refresh flows
See exactly what a token carries after sign-in, verify the 'sub' matches the logged-in user, and check whether an access token has already expired before you blame the network layer.
- QA & security testers
Validate token hardening
Check that tokens set sensible lifetimes and 'nbf' windows, confirm the signing algorithm is what you expect, and verify HS256 signatures against a test secret during pen-testing.
- Support & DevOps
Triage auth incidents fast
When a customer reports 'logged out randomly', paste their token to read the expiry and issued-at claims and turn a vague report into a precise timing answer in seconds.
Supported formats
Accepts JWT, JWS, Base64URL token, .txt and .jwt, and produces JSON, Decoded claims and Copied text, all processed locally in your browser.
- JWT
- JWS
- Base64URL token
- .txt
- .jwt
- JSON
- Decoded claims
- Copied text
Frequently asked questions
Recommended tools
Unix Timestamp Converter
Convert Unix timestamps to human dates and back, with a live-ticking epoch clock, auto seconds/milliseconds detection, and ISO 8601, UTC, local and relative time, all in your browser.
Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 checksums of any text or file at once, generate HMAC signatures with your own key, and verify a download against its expected hash, all in your browser, nothing uploaded.
JSON Formatter
Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.
JSON Diff
Compare two JSON documents by structure, not text. Reordered keys and whitespace are ignored. You see added, removed and changed values by path with counts, all in your browser.
JSON to TypeScript
Convert JSON to TypeScript interfaces or types instantly, with merged unions across array items, optional-from-null, readonly, export and naming controls, 100% in your browser.
JSON Tree Viewer
Explore JSON as an interactive, collapsible tree. Expand or collapse any branch, see type and array-length badges, search keys and values with live highlighting, and copy any node's value or its JSONPath in one click, all 100% in your browser.
Comparisons & guides
Go deeper on the concepts behind the jwt decoder.
Common problems, solved
Hit a snag? Here are quick fixes for the issues people run into most.
'A JWT must have 2 or 3 dot-separated parts' error.
You've likely pasted a partial token or an extra fragment. A JWT looks like xxxxx.yyyyy.zzzzz. Make sure you copied the whole string with both dots and no surrounding quotes, and that a 'Bearer ' prefix wasn't included.
The header or payload won't decode as JSON.
This usually means a character was mangled in transit, a '+' turned into a space, or the string got line-wrapped. Re-copy the token in one piece. The tool already handles Base64URL padding, so you don't need to add '=' characters yourself.
HS256 verification says invalid but the secret is right.
Confirm the token's 'alg' is actually HS256 (an RS256 token can't be verified with a shared secret), and check the secret has no hidden trailing whitespace. Also ensure it's the exact raw key used server-side, byte for byte.
Timestamps look wrong or off by hours.
The dates are computed from your device clock and shown in both UTC and your local zone. A machine with an incorrect clock or timezone will make a valid token appear expired or not-yet-valid, sync your system time and re-decode.
Get the most out of it
The payload is only encoded, not encrypted. Never store anything secret in a JWT claim, because anyone with the token can read it in a decoder like this one.
If verification fails on a token you trust, check for a trailing newline or whitespace when you copied the secret, and confirm the secret is the raw signing key, not a Base64 wrapping of it.
A token can be perfectly valid by signature yet expired by time, always read the validity badge, not just the verifier result.
Use the share link to hand a teammate the exact token you're looking at. The token travels in the URL fragment, so it still never touches a server.
When comparing two tokens, decode one, copy its payload, then paste the next, the copy buttons make diffing claims by eye much faster.
What's new
Recent updates and improvements to the jwt decoder.
Initial release: three-pane header/payload/signature view, human-readable iat/exp/nbf, live validity badge, and local HS256 signature verification.
Added drag-and-drop and paste import for .jwt/.txt files, per-part copy buttons, and shareable deep links that carry the token in the URL fragment.
Refined the expiry badge to show precise seconds remaining, surfaced 'not before' warnings, and added keyboard shortcuts with an in-app reference.
Keep exploring
Problems we solve
Definitions
From the blog
Explore categories
Compare formats
By file type
Common tasks
Your privacy is built in
Your JWT and any secret you enter are processed entirely in your browser with JavaScript and the Web Crypto API. Nothing is uploaded, stored, or logged on our servers, which is precisely why it's safe to inspect real, live tokens here. Note that decoding a token only reveals its contents. It does not prove the token is authentic. Treat any token you paste as a live credential and clear it when you're done.
- Runs in your browser
- No uploads
- Nothing stored
Ready to try the jwt decoder?
Free, private and instant. JWT Decoder runs right in your browser.