JWT Decoder Online Free: Inspect Header and Payload Safely

A JWT is three Base64url-encoded segments joined by dots: a header saying which algorithm signed it, a payload carrying the claims, and a signature. The property that surprises people most is that the payload is not encrypted. It is merely encoded, which means anyone holding the token can read every claim inside it without a key, a password or this tool - decoding is a two-line operation in any language. That is by design: JWTs are meant to be readable by the client and verifiable by the server. What the signature protects is integrity, not secrecy. Change a single character of the payload and the signature no longer matches, so the server rejects it. This distinction has a practical consequence worth stating plainly: never put anything confidential in a JWT payload, because it is effectively public to whoever holds the token. Decoding here happens entirely in your browser.

Key benefits

• Shows exactly what a token claims, which turns guesswork into a two-second check when debugging auth.
• Formats the payload as readable JSON rather than a wall of encoded characters.
• Handles Base64url correctly, so tokens decode where a plain Base64 decoder fails.
• Runs in your browser - the token is never transmitted to a server.
• No account and no rate limit.

How to use it, step by step

1. Paste the token. Paste the full JWT including both dots. The three segments are split and decoded automatically.
2. Read the header. It names the signing algorithm - HS256, RS256 and so on - and the token type. This is the first thing to check when verification is failing.
3. Read the payload claims. The claims are shown as formatted JSON. Look for exp (expiry), iat (issued at), iss (issuer), aud (audience) and sub (subject).
4. Check the expiry. exp and iat are Unix timestamps in seconds. An expired token is the single most common cause of a 401 that "worked yesterday".

Common use cases

• Debugging a 401 by checking whether the token has actually expired.
• Confirming that a login flow issues the roles, scopes or permissions you expect.
• Checking the audience and issuer claims when a token is rejected by an API.
• Inspecting a token from a third-party identity provider to see what it contains.
• Learning how JWTs are structured while implementing authentication.

Pro tips

• Check exp first. Timestamps are Unix seconds, not milliseconds - a value like 1767225600 is seconds; JavaScript's Date.now() gives milliseconds.
• A mismatch between the aud claim and what the API expects is the second most common rejection after expiry.
• The alg in the header tells you what the server must verify with. If it says "none", treat the token as untrusted.
• Use an expired or test token when you are only exploring structure - habit matters more than any single tool being safe.
• To create signed tokens for testing rather than read them, use the JWT Encoder.

Common mistakes to avoid

• Assuming the payload is private. It is readable by anyone holding the token, so personal data and secrets do not belong in it.
• Treating a successful decode as proof the token is valid. Decoding ignores the signature entirely.
• Storing JWTs in localStorage where any XSS can read them. An httpOnly cookie is the safer default.
• Reading exp as milliseconds and concluding a valid token has expired, or the reverse.
• Pasting a live production token that grants real access into any third-party site out of habit.

Frequently asked questions

How do I decode a JWT?

Paste the token above. The header and payload are decoded and shown as formatted JSON immediately - no key is needed, because those segments are only encoded.

Is this JWT decoder free?

Yes. No account, no limit, and the token never leaves your browser.

Does decoding verify that the token is valid?

No. Decoding reads the header and payload; it does not check the signature. A decoded token tells you what it claims, not whether it is genuine or unmodified - only the server holding the signing key can determine that.

Is the JWT payload encrypted?

No. It is Base64url-encoded, which is reversible by anyone. The signature protects against tampering, not against reading, so never put confidential data in a payload.

What are the three parts of a JWT?

Header (signing algorithm and token type), payload (the claims), and signature (proves the first two have not been altered). They are separated by dots and each is Base64url-encoded.

How do I check if a JWT has expired?

Look at the exp claim, a Unix timestamp in seconds. Compare it against the current time in seconds - if exp is smaller, the token has expired, which is the usual cause of a sudden 401.

People also search for

• jwt decoder online
• decode jwt token free
• jwt debugger
• is jwt payload encrypted
• check jwt expiry
• jwt vs session token
• json web token explained

Ready to get started? Open the JWT Decoder and try it now - completely free.