JWT Decoder

The JWT Decoder is a free jwt decoder and jwt token viewer that splits a JSON Web Token into its header and payload and pretty-prints both as readable JSON, so you can inspect claims, signing algorithms and expiry times while debugging authentication flows. It works as a client-side jwt debugger — paste a token, read every claim, done.

JWTs show up everywhere in modern auth: OAuth access tokens, API session tokens, single sign-on assertions, and custom application tokens. When a login flow breaks, an API call gets a 401, or a token expires earlier than expected, the fastest way to understand why is to actually look inside the token, and decoding base64url by hand is tedious. This tool does that instantly, and also decodes well-known time claims (exp, iat, nbf) into human-readable dates, flagging an expired token with a clear warning instead of leaving you to convert Unix time in your head. Custom claims specific to your application — roles, permissions, tenant IDs — are decoded and displayed just like standard claims, so you can confirm an access token actually carries the scopes your API expects before chasing a bug elsewhere in the stack.

It correctly handles the URL-safe Base64 alphabet that JWTs use (- and _ instead of + and /) and tolerates missing padding, both common causes of 'invalid token' errors in naive decoders. A leading 'Bearer ' prefix, often copied along with the token from an Authorization header, is stripped automatically.

Importantly, this tool decodes only — it does not and cannot verify the signature, since that requires the server's signing secret or private key. A token can be decoded and read perfectly while still being invalid, expired or tampered with; decoding tells you what a token claims, not whether those claims are trustworthy. Everything happens locally, since JWTs often carry live session credentials.