JWT Decoder | A free, easy online tool

Your JWT

Decoding only — the signature is not verified. Never paste production tokens you don't own.

Decoded

Paste a JWT above to see its decoded contents.

Decode URL HTML Decode Base64 Decode JWT Decode

How it Works

A JSON Web Token has three Base64URL-encoded segments separated by dots: header.payload.signature. This tool splits the token, decodes the first two parts back into JSON, and pretty-prints them. The signature is shown as-is — verifying it requires the issuer's secret or public key.

What You'll See

Header: Token type and signing algorithm (e.g. HS256, RS256).
Payload: The claims — sub, iss, aud, custom fields, and timestamps.
Issued / Expires: Human-readable conversion of iat and exp timestamps with a relative "in 2h" or "expired 4d ago" indicator.

Common Use Cases

Debugging auth flows: See exactly what claims your backend is sending.
Inspecting expiry: Quickly check whether a token is still valid.
API integration: Verify the issuer, audience, and scopes match expectations.
Learning OAuth/OIDC: Understand what's actually inside an access or ID token.

Important — Decoding Only

This tool does not verify the signature. A decoded token tells you what the issuer claimed, not whether the claim is authentic. Treat decoded contents as informational only.

Privacy and Security

Tokens are decoded locally in your browser. Nothing is sent to a server, logged, or stored. Even so — never paste production tokens belonging to systems you don't own.

Decoding Tools

URL Format Decoder - Transform text from a URL into readable characters.
HTML Entity Decoder - Decode HTML entities back to readable text characters.
Base64 Decoder - Decode Base64 strings back to plain text to read encoded data.