Decoded header
-
Private JWT inspection
Free JWT Decoder - Fast Browser Tool
Read JWT headers, payloads, signatures, expiration times, and registered claims directly in your browser. Optionally verify HMAC signatures without uploading your token or secret.
No uploads
Claim analysis
HMAC verification
No browser storage
JWT Decoder
Paste a three-part compact JWT to decode its protected header, claims payload, and signature segment locally.
Encoded JWT
0 charactersEnter a compact JSON Web Token containing header, payload, and signature segments separated by periods.
Decoded token
Review the content and verification state before using any claim.
Algorithm
-
Token type
-
Payload claims
0
Encoded size
0 B
Decoded payload
-
Signature segment
0 bytes-
Claim analysis
No time limitsNumericDate values are interpreted as seconds since the Unix epoch using the current device clock.
Issued at · iat
Not present
Expires · exp
Not present
Not before · nbf
Not present
- Issuer
- Subject
- Audience
- Token ID
No iss, sub, aud, or jti claims were found.
Optional HMAC verification
-Decode a token to check whether local HMAC verification is available.
Verification proves only that the signature
matches this secret and algorithm. Your application
must still validate issuer, audience, time claims,
and authorization policy.
01
Local decoding
The token stays in this tab
02
Strict parsing
Base64url and UTF-8 validation
03
Claim insights
Time and identity claim analysis
04
Optional verification
HS256, HS384, and HS512
Decode JWT data without uploading it
This JWT Decoder reads the compact token format and converts its Base64url-encoded header and payload into readable JSON. Decoding happens locally, so the token does not need to be submitted to an external API.
The decoder also analyzes common registered claims such as iss, sub, aud, iat, exp, nbf, and jti. Time-based claims are compared with the current device clock to identify expired or not-yet-active tokens.
Decoding is not the same as validation
Anyone who has a standard signed JWT can normally decode its header and payload. Authenticity comes from signature verification and application-level validation-not from Base64url decoding.
Useful inspection features
A focused JWT analysis workflow
Decode the token, inspect its claims, understand its time state, and verify supported HMAC signatures when required.
Strict JWT decoding
Detect malformed segments, invalid Base64url, broken UTF-8, invalid JSON, and unsupported unencoded payloads.
Readable JSON output
View formatted header and payload JSON inside bounded, scrollable panels that handle long tokens cleanly.
Time claim analysis
Interpret iat, exp, and nbf values and identify expired, future-issued, or not-yet-active tokens.
HMAC verification
Verify HS256, HS384, and HS512 signatures locally using the algorithm declared by the protected header.
Copy and export
Copy the original token or formatted JSON and download a decoded report that never includes the verification secret.
Private by default
No network request, tracking call, cookie, localStorage entry, or third-party JWT package is used.
Three simple steps
How to decode a JWT online
Inspect a compact JSON Web Token without installing a library or submitting it to a remote service.
01
Paste the token
Enter a compact JWT containing header, payload, and signature segments separated by periods.
02
Decode and inspect
Review formatted JSON, registered claims, time status, algorithm information, and signature bytes.
03
Verify if required
For supported HMAC tokens, provide the correct secret to verify the signature locally with Web Crypto.
JWT anatomy
What is inside a JSON Web Token?
A compact signed JWT generally contains three Base64url segments joined with periods.
Header
Describes token metadata, commonly including the signing
algorithm in
alg and token type in
typ.
Payload
Contains claims about a subject, issuer, audience,
timestamps, permissions, and application-specific data.
Signature
Protects the encoded header and payload against undetected
modification when verified with the correct key and
algorithm.
Safe JWT handling
Important JWT validation practices
Decoded data should remain untrusted until every security and application policy requirement has been validated.
1
Allowlist algorithms
The verifier should enforce expected algorithms rather than accepting any alg value supplied by a token.
2
Validate issuer and audience
Confirm that iss and aud identify trusted parties for the specific application and authentication flow.
3
Check every time constraint
Apply expiration, not-before, issued-at, clock-skew, and maximum token-age policies on trusted infrastructure.
4
Keep secrets on the backend
Production HMAC secrets and private keys should not be embedded in frontend code or exposed to browser clients.
Common questions
JWT Decoder FAQ
What does a JWT decoder do?
A JWT decoder reads the Base64url-encoded header and payload of a JSON Web Token and displays their JSON content. Decoding alone does not prove that the token is authentic or trustworthy.
Does decoding a JWT verify its signature?
No. Decoding only reveals the token content. This tool can separately verify HS256, HS384, and HS512 signatures when you provide the correct HMAC secret.
Is my JWT uploaded or stored?
No. Decoding and optional HMAC verification happen locally in your browser. This page does not upload your token or secret and does not save them in browser storage.
Can this tool decode an expired JWT?
Yes. Expired tokens can still be decoded because expiration affects token acceptance, not Base64url decoding. The claim analysis will identify an expired exp value.
Is JWT content encrypted?
Usually not. A standard signed JWT is encoded rather than encrypted, so anyone who receives it can decode its header and payload. Confidential information should not be placed in a signed JWT.
What does alg none mean in a JWT?
The alg value none describes an unsecured JWT without a cryptographic signature. Applications should not accept it unless an explicitly designed and trusted protocol requires unsecured tokens.
Can decoded claims be used directly for authorization?
No. An application should validate the signature, allowed algorithm, issuer, audience, expiration, not-before time, and other policy requirements before trusting claims for authentication or authorization.
Continue working
Guide & Security
Related developer tools
Generate tokens, inspect encoded data, and format JSON for development and testing.
AI Agent Security Guide
Learn how browser agents access tokens, session claims, and web permissions.
Token creationJWT Generator
Create and sign development JWTs with custom claims and secure browser-generated HMAC secrets.
Data encodingBase64 Encoder & Decoder
Encode and decode text or data using standard Base64 tools for development workflows.
JSON utilityJSON Formatter
Format, validate, and inspect JSON structures with readable indentation and syntax checks.