JWT Decoder
Decode a JWT's header and payload without verifying it.
- Reading time:
- 2 min
- Last updated:
- Price:
- Free, no signup
Type or paste text to see the result.
What the JWT Decoder does
Paste a JSON Web Token — the long string starting 'eyJ...' — and see its header and payload as readable JSON. You'll spot the algorithm, the user ID ('sub'), and timestamps like 'exp' (expiry) and 'iat' (issued at).
The token is only decoded, not verified, and it never leaves your browser, which matters because real tokens can grant access to accounts.
Why the JWT Decoder is useful
When an API returns 401 Unauthorized, the first question is usually 'what's actually inside this token?' — has it expired, is the audience wrong, is a role missing?
Many online decoders send tokens to a server. Decoding locally avoids handing a live credential to a stranger.
Also known as: jwt decoder, decode jwt token, json web token decoder, free jwt decoder, online jwt decoder, jwt decoder online free, jwt decoder tool.
How to use the JWT Decoder
- 1
Copy the token
From an Authorization header, a cookie or local storage.
- 2
Paste it in
The header and payload appear as formatted JSON.
- 3
Check the claims
Look at exp, iss, aud and any role fields.
Key features
- Decodes header and payload
- Pretty-printed JSON
- Handles URL-safe Base64
- Local only — no network calls
Benefits
- Debug login problems faster
- Confirm expiry times and roles
- Keep live tokens private
Real-life use cases
Users being logged out
A developer decodes a token from a bug report and sees exp is only five minutes after iat, revealing a misconfigured session length.
Missing admin access
A tester decodes their token and finds the 'role' claim says 'user', explaining why the admin page refused them.
Tips for the best results
- 'exp' and 'iat' are Unix timestamps in seconds — paste them into the Timestamp Converter to read the date.
- Decoding isn't validation: anyone can create a token with any payload. Servers must verify the signature.
- Never paste production tokens into tools you don't trust, and revoke any token you've shared accidentally.
Conclusion
Paste a JWT to read its header and claims instantly, privately, and find out why authentication is failing.
Frequently asked questions
Does it verify the signature?
- No. It only decodes the readable parts; verification needs the secret or public key.
Is my token sent to a server?
- No. Decoding runs in your browser.
What does 'exp' mean?
- The expiry time, in seconds since 1 January 1970 (UTC).
Why are there three parts?
- Header, payload and signature, separated by dots.
Is the payload encrypted?
- Usually not — it's just Base64URL, so never put secrets in it.
Why does decoding fail?
- The token may be cut short, contain spaces, or be an encrypted JWE instead of a standard JWT.
Related tools you may need
- URL Decoder — Decode percent-encoded URL strings back to plain text.
- Base64 Decoder — Decode Base64 back to readable UTF-8 text.
- JSON Validator — Check whether your JSON parses and see the exact error location.
- JSON Diff Checker — Compare two JSON documents and list every difference.
- JSON Path Extractor — Pull a value out of JSON using a dot-notation path.
- CSV to JSON Converter — Turn CSV rows into a JSON array of objects.
- Cron Expression Explainer — Translate a 5-field cron expression into plain English.
- XML Formatter — Beautify XML with clean two-space indentation.
Keep exploring
Browse the full tools directory, filter by category, or read guides on the Text Tools Hub blog.