Free Online JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It has three parts separated by dots: a header, a payload, and a signature. The header and payload are just Base64URL-encoded JSON — they are encoded, not encrypted — so anyone holding the token can read them. That is exactly what this decoder does: it splits the token, decodes the header and payload, and pretty-prints the JSON so you can inspect the claims. Common payload claims include "sub" (subject / user id), "iat" (issued at), "exp" (expiration), and "nbf" (not before). This tool converts the timestamp claims to readable UTC dates and tells you at a glance whether the token has expired. Because the header and payload are not encrypted, you should never put secrets in a JWT payload. The signature is what protects a token from tampering — but verifying it requires the signing secret or public key, which this tool does not have and never asks for. That is why decoding happens entirely in your browser: your tokens are never sent to a server, making it safe to inspect production tokens that contain sensitive claims.