JWT Decoder
Decode any JSON Web Token in your browser. Header, payload and signature, with human-readable exp, nbf and iat times and warnings for expired or unsecured tokens. No token is uploaded, no sign-up, no watermark.
- Header and payload decoded as JSON
- exp, nbf and iat shown as readable times
- Expiry and alg none warnings
- Your token never leaves your device
Paste a JWT above to decode it. The header, payload and signature appear here instantly.
Everything runs in your browser. Your token is never sent anywhere.
- 100% Free
- No Sign-Up
- No Upload
- Decodes Header, Payload
- Timestamp Decoding
- Works Offline
Registered JWT claims explained
Ten claims you will see in most tokens, with what each one means and an example value.
| Claim | Meaning | Example | Notes |
|---|---|---|---|
| iss | Issuer | https://auth.example.com | Which identity provider created the token |
| sub | Subject | user_1234 | Who the token is about. Usually the user ID |
| aud | Audience | https://api.example.com | Which service is meant to accept this token |
| exp | Expiration | 1700000000 | Unix seconds. After this, the token must be rejected |
| nbf | Not before | 1699999000 | Unix seconds. Before this, the token must be rejected |
| iat | Issued at | 1699998000 | Unix seconds. When the token was created |
| jti | JWT ID | a1b2c3d4 | Unique identifier used to prevent replay |
| scope | Scopes | read:profile write:posts | OAuth scopes granted by the token |
| roles | Roles | ["admin","user"] | Application-defined roles, not a registered claim |
| azp | Authorized party | client_abc | Which client the token was issued to |
Signing algorithms you will see in the header
The alg claim is the single most important field in the header. It decides how the signature was produced and what the server must do to verify it.
| alg | Family | Key | Notes |
|---|---|---|---|
| HS256 | HMAC | Shared secret | Symmetric. Same secret signs and verifies. Simple but the secret must stay secret on every service |
| HS384 | HMAC | Shared secret | Same as HS256 with a larger output |
| HS512 | HMAC | Shared secret | Same as HS256 with the largest output |
| RS256 | RSA | Private signs, public verifies | Asymmetric. Auth server signs with a private key, every other service verifies with a public key |
| ES256 | ECDSA | Private signs, public verifies | Asymmetric and shorter keys than RSA. Common in modern auth providers |
| PS256 | RSA-PSS | Private signs, public verifies | RSA with PSS padding. Stricter than RS256 |
| none | None | No key | Unsecured. Never accept a token with this algorithm in production |
Why this is the best free JWT decoder
Most JWT decoders send your token to a server for decoding. This one never does, and it gives you readable timestamps and status badges on top.
| Feature | TToolDeck | Server side decoders | Desktop libraries |
|---|---|---|---|
| Runs entirely in your browser | Yes | No | Yes |
| No sign-up or email | Yes | Yes | Partial |
| Decodes header and payload | Yes | Yes | Yes |
| Human-readable exp, nbf, iat | Yes | Partial | No |
| Expiry warning and status badges | Yes | No | No |
| Warns on alg none | Yes | No | No |
| Descriptions for known claims | Yes | Partial | No |
| No account, no quota, no rate limit | Yes | Yes | Yes |
| Token never leaves the device | Yes | No | Yes |
| Works offline after first load | Yes | No | Yes |
Comparison reflects publicly available information at the time of writing. Features may change. Representative examples of common patterns.
More free developer tools
Free browser-based tools. Nothing uploaded, ever.
Hash Generator
MD5, SHA-1, SHA-256, SHA-384, SHA-512 from text or files
Base64 and URL Encoder
Encode and decode Base64 and URL strings
Diff Checker
Compare two texts or code files side by side
JSON Formatter
Format, validate and minify JSON
Password Generator
Strong random passwords generated locally
Meta Tag Generator
SEO and social meta tags with live preview
How it works
- 1
Paste the token
Copy the full JWT including all three parts. Paste it into the input box. Decoding happens instantly, no button to press.
- 2
Read the header, payload and signature
The header shows the algorithm and type. The payload shows the claims. The signature shows the raw bytes the server will verify.
- 3
Check the status badges
A green, amber or red badge next to exp, nbf and alg tells you at a glance whether the token is still valid, about to expire, or unsecured.
Everything you get for free
Decodes all three sections
Header, payload and signature are split and colour-coded so you can see at a glance which part is which. Header and payload are pretty-printed JSON.
Human-readable timestamps
exp, nbf and iat are Unix seconds in the raw token. The tool converts them to a UTC date, a relative time and a status badge: valid, expired or expires soon.
Expiry and not-before warnings
If exp is in the past, a warning appears saying the token has expired. If nbf is in the future, a warning appears saying it is not yet valid. No more guessing from numbers.
alg none warning
If the token header says "alg": "none", that is the algorithm confusion attack surface in plain sight. The tool flags it in red immediately.
Known claim descriptions
iss, sub, aud, exp, nbf, iat, jti, scope, roles and other registered claims are annotated with what each one means, so you do not have to look them up.
Copy header, payload or signature
One click copies the pretty-printed header JSON, the pretty-printed payload JSON or the raw signature. Paste into a bug report, a test, or a colleague chat.
Handles UTF-8 payloads
Non-Latin characters in the payload decode correctly because the base64url layer is decoded as bytes first, then as UTF-8 text. Emoji and accented names do not break.
Zero upload, zero logging
The token is decoded in JavaScript on your device. Nothing is sent to a server. You can paste a production token without worrying about it being logged anywhere.
What people use it for
Debugging an auth flow
When login succeeds but subsequent requests fail, decoding the access token tells you whether it has the wrong audience, the wrong subject or an expired exp.
Checking roles and scopes
Most authorization is decided from the token payload. Decode it and read the roles, scope or permissions claims to see exactly what the server will allow.
Inspecting OAuth tokens
Access tokens from Auth0, Okta, Firebase Auth, Cognito and Supabase are all JWTs. Paste one to see the issuer, audience and expiry without leaving your browser.
Verifying exp in production
Before you file a bug about unexpected logouts, decode a real token and see exactly how long it was set to live. The relative time badge tells you in plain English.
Learning how JWTs work
Nothing beats seeing a real token decoded. Paste an example from the jwt.io docs and read the header, payload and signature side by side.
Copying claims into a test
When you write an integration test, you often need the exact payload of a real token. Decode here, copy the pretty-printed JSON, paste into your fixture.
Questions people ask
What is a JWT?
A JSON Web Token is a compact, URL-safe way of representing claims between two parties. It has three parts separated by dots: a header that says how it was signed, a payload that carries the claims, and a signature that proves the issuer produced it. The header and payload are just base64url-encoded JSON, which is why anyone can read them.
Is this JWT decoder free?
Yes. Every field and every preview is free to use with no sign-up, no watermark and no daily limit. ToolDeck may show ads to pay for hosting, but they never lock a feature.
Is my token uploaded to a server?
No. The decoding happens entirely in JavaScript on your device using the built-in atob and TextDecoder APIs. Nothing is sent to ToolDeck or any third party, and you can confirm this by watching your browser network tab.
Is it safe to paste a production token here?
Because nothing is uploaded, the token never leaves your device. It is safe in the sense that there is no server to log it. That said, any JavaScript on any page can read what you paste, so use a token from a test environment if you want to be extra careful.
Does this tool verify the signature?
No. Verifying a signature needs either the shared secret (for HS256) or the public key (for RS256 and ES256), and it should always be done on the server that issued or accepts the token. Decoding here only shows the parts, so you can debug the claims and the timestamps.
What does the alg none warning mean?
Some older JWT libraries accepted tokens with "alg": "none", which means there is no signature at all. That was a real security hole. The tool flags it in red so you can immediately spot a token that should never be accepted.
What does exp mean and why does the tool show expired?
exp is the expiration time in Unix seconds. After that moment, the server is supposed to reject the token. If exp is in the past, the tool shows an expired badge so you know the token is no longer valid.
What is the difference between exp, nbf and iat?
iat is when the token was issued, nbf is the earliest time the token may be used, and exp is the latest time it may be used. Most tokens only set iat and exp. Some, especially short-lived access tokens, also set nbf.
Why does the payload look like random letters and numbers?
The header and payload are base64url encoded, which is not encryption. Anyone can decode them. What keeps a JWT secret is the signature, which proves the issuer produced the token and that nobody changed the payload.
Can I decode a token that was signed with RS256?
Yes. Decoding does not need the key. The tool shows the header, the payload and the raw signature. What it cannot do is verify the signature, because that needs the public key.
Can I use this offline?
Yes. After the page first loads, the decoder keeps working without an internet connection because everything runs locally in JavaScript.
Which browsers are supported?
Current versions of Chrome, Edge, Firefox and Safari, on desktop and mobile. Everything uses standard web APIs and no browser specific features.
Your token never leaves your browser
The token is decoded in JavaScript using the built-in atob and TextDecoder APIs. There is no server side decoding, no logging of your token and no analytics on the content itself. You can confirm this by watching your browser network tab while using the tool. Read how we keep it private.