Private browser-based developer tool
JWT Decoder
Decode and inspect JSON Web Tokens instantly. Read the header, payload, claims and expiration status without sending your token to a decoding API.
100% client-side. Your JWT is decoded in this browser tab and is not sent to a decoding API or stored by this tool.
Client-side
Token decoding runs in your browser tab.
No secret needed
Read signed JWT headers and payloads without a signing key.
Time-aware
Inspect exp, iat and nbf as readable UTC timestamps.
Decode ≠ verify
Successful decoding never implies signature authenticity.
What is a JWT decoder?
A JWT decoder turns the Base64URL-encoded header and payload into readable JSON. A typical signed JWT has header, payload and signature segments.
I use decoding to inspect alg, kid, issuer, audience, scopes, roles and time claims while debugging authentication.
Reading a token is not the same as trusting it. Verify the signature and validate the claims before accepting it.
JWT claims explained
Common registered claims help explain who issued the token, who it targets and whether it is inside its valid time window.
issIssuer
Identifies the principal that issued the JWT.
subSubject
Identifies the subject represented by the token.
audAudience
Identifies the intended recipients.
expExpiration
The time after which the token should not be accepted.
nbfNot Before
The time before which the token should not be accepted.
iatIssued At
The time at which the token was issued.
Decode, validate and verify are different jobs
Decode
Read Base64URL header and payload data as JSON.
More JWT debugging tools
JWT Expiry Checker
See whether a token is expired, active or not active yet.
JWT Validator
Check structure and common validation conditions.
Signature Verifier
Verify JWT signatures with supported keys and algorithms.
JWKS Validator
Match kid to a trusted JWK and verify public-key JWT signatures.
JWT Debugger
Investigate issuer, audience and time-claim problems behind authentication errors.
Advanced JWT and identity tools
Go beyond decoding with security-policy checks, token comparison, OIDC discovery validation and JWK inspection.
JWT Security Analyzer
Inspect a JWT for policy-sensitive security signals such as alg=none, unexpected algorithms, token-controlled key URLs, suspicious kid values, time claims, issuer and audience mismatches.
JWT Diff
Compare two JWTs field by field to see what changed in the decoded header and payload after refresh, login, environment changes or key rotation.
OIDC Discovery Checker
Check OpenID Connect or OAuth authorization-server metadata from an issuer URL, validate exact issuer matching and inspect JWKS and endpoint metadata in your browser.
JWK Inspector
Inspect a single JSON Web Key, identify key type and usage metadata, detect private key material and compute an RFC 7638 SHA-256 JWK thumbprint locally.
JWT Code Examples
Decode JWT header and payload safely in JavaScript, Node.js, Python, Java, C#, Go and PHP, with correct Base64URL and UTF-8 handling.
JWT Claims Reference
Reference 48 JWT, OpenID Connect and OAuth claims with value types, source specifications and validation notes for registered, identity and authorization fields.
Recommended JWT decoder guides
When I need more than a raw decode result, these are the next guides I open.
How I Decode a JWT Without a Secret
Read a JWT safely without confusing decoding with verification.
Read guide →How I Decode a JWT in JavaScript Without Trusting It
Handle Base64URL, UTF-8, Bearer prefixes and exp parsing.
Read guide →How I Read JWT Claims: iss, aud, exp, sub and More
Interpret the most important JWT claims.
Read guide →How I Check the JWT exp Claim and Expiration Time
Convert exp correctly and understand token timing.
Read guide →JWT Decoder FAQ
Can I decode a JWT without the secret?
Yes. Signed JWT headers and payloads are normally Base64URL encoded. The secret or public key is required for signature verification, not for reading claims.
Does decoding prove that a JWT is valid?
No. Decoding only proves that the structure and JSON are readable. Authenticity requires signature verification and application validity can depend on exp, nbf, iss and aud.
Validate a JWTIs my JWT uploaded?
The decoder runs in browser-side code and does not send token text to a decoding API.
What do exp, iat and nbf mean?
exp is expiration, iat is issued-at and nbf is not-before.
Check JWT expirationWhy can a decoded JWT still cause a 401?
It may be expired, not active, signed with the wrong key, issued by the wrong issuer, intended for another audience or missing required authorization data.
Debug a JWTAvoid pasting live production credentials when a synthetic or redacted token can reproduce the issue. Browser-side processing cannot protect against extensions or malware on your device.