JWT Decoder
Decode JWT header and payload directly in your browser.
Loading tool...
Inspect JWT headers and payloads quickly
JWT Decoder expands access tokens, ID tokens, and session tokens into readable header and payload JSON in the browser. Use it to inspect alg, sub, iss, aud, iat, exp, and other claims without sending the token to a server.
Useful For
- Check API token expiration
- Inspect OAuth or OIDC ID token claims
- Compare token payloads between frontend and backend flows
Good To Know
Do not share sensitive real tokens. This tool does not verify signatures; it only decodes structure and claims locally.
Developer Check
Generated code, regexes, meta tags, and config snippets should be treated as drafts and tested again in your runtime, security policy, and deployment environment.
How It Works
Inputs are calculated or converted in the browser whenever possible. Compare important results with the original source before using them. Reviewed on Jul 2, 2026.
JWT decoding checks
Token shape
- Check that header, payload, and signature segments exist
- Remove Bearer prefixes or extra spaces before pasting
Claims
- Review exp, iat, aud, iss, and other claims first
- Compare timestamp claims in UTC and local time
Security
- Decoding is not verification or authentication
- Do not share real tokens; mask only the fields you need to inspect
No. This tool decodes the header and payload so you can inspect token contents more easily.
Avoid pasting sensitive production tokens. Tokens may contain user, permission, or session information.
Decoding is designed to run in the browser by default, and pasted tokens are not stored on the server.