BrowserTools

JWT Decoder

Inspect JWT header, payload and expiry

By Guga — BrowserTools maintainer, Tbilisi, Georgia Updated 2026-09-12
Free Private No uploads
What is JWT Decoder?

A JSON Web Token looks like three Base64url chunks separated by dots, and the first two are simply encoded JSON. This tool decodes those and shows you the header, the payload, the algorithm the header claims, and whether the expiry and issue times are in the past. That is genuinely useful when you are reading a token you were just handed and want to know what it actually contains: which issuer, which subject, what scopes, when it stops being valid. What it cannot do is verify anything. Checking a signature needs the key the token was signed with, and no amount of reading the payload substitutes for that. A token that decodes perfectly here could be forged.

Decode JSON Web Tokens and inspect their header, payload, algorithm, issued-at and expiry times in a readable, color-coded view. Tokens are parsed locally and never sent anywhere.

Private JWT Decoder In Your Browser

JWT Decoder is processed locally with client-side JavaScript. Your files never touch a server, and there is no queue to wait in.

Step-by-Step

How to use JWT Decoder

1

Paste the token into the field marked JSON Web Token, optionally with a leading Bearer and spaces.

2

Read the Header and Payload blocks, both pretty-printed with indentation.

3

Check the chips below them for the algorithm and for the expiry and issue times in relative form.

4

Verify the signature through whatever issued the token — the decode alone tells you nothing about authenticity.

Key Capabilities
  • Header and payload decoded from Base64url and pretty-printed as JSON
  • Algorithm shown from the header so you can see which is claimed
  • Expiry and issue times reported as relative values such as in 2 hours or 3 days ago
  • Tolerates a Bearer prefix, surrounding whitespace and missing Base64 padding
Common Use Cases
  • A developer inspecting an access token from an API response to see which scopes it grants.
  • An engineer debugging why a client is being rejected by checking whether the expiry has already passed.
  • A student learning JWT structure by reading the header and claim set of a real token.
Clear Answers

Frequently Asked Questions

Can this tell me whether a token is genuine?
No, and treating a successful decode as proof of authenticity is the classic mistake behind JWT confusion attacks. Verification needs the signing key, the expected algorithm and a check that the signature is valid over the exact header and payload bytes. A forged token decodes here just as cleanly as a genuine one — always confirm the token came from a channel you trust.
Why does my token show as invalid?
Two common reasons. An encrypted token has five dot-separated parts and no readable payload, because the middle section is ciphertext rather than Base64url JSON. A token signed with alg set to none is also deliberately unusable, and anything that is not a JSON object in those positions fails to parse. Malformed padding and stray characters are stripped before parsing.
What if there is no expiry claim?
The chip reads no expiry claim, which means the token does not expire on its own. That is a real finding worth noticing: a token without an exp claim stays valid until the issuer decides otherwise, or forever if the issuer never revokes it. Most security guidance treats a non-expiring token as a defect.
Should I paste a production token into a web page?
Only if you trust the page, because a token is a bearer credential — whoever holds it can act as the user until it expires. The parsing here happens in the browser with no request made, so the string is not sent anywhere, but a page you do not control could still capture it. For production tokens, decode them with tooling you have audited.

Related Guides

View all guides →
Encoders & ConvertersURL Encoding: %20, %2F, Plus Signs & RFC 3986Two escaping systems, one job each. Percent-encoding makes a value safe to travel inside a URL: %2F is an escaped slash, %3F an escaped question mark, %20 an escaped space. HTML entities solve a different problem entirely, making text safe inside markup rather than inside an address. Which one you need, what RFC 3986 actually requires, and the three mistakes that break most links are below; to convert a real string instead, the free URL Encoder / Decoder applies exactly those rules locally.