Built and fact-checked by the DocNectar team — see our editorial standards
Key Features
Instant Calculation
Get accurate results in real time with our optimized algorithm.
Mobile Friendly
Fully responsive design. Works on all devices & screen sizes.
Privacy Focused
Your data stays on your device. We don't store any inputs.
100% Free
No hidden costs. This tool is completely free forever.
JSON Web Tokens (JWTs) encode their header and payload as base64url, making them readable without a secret key — but not always easy to inspect by hand. This tool decodes both parts instantly so you can check claims like expiry, issuer, or subject during debugging.
Important: this tool decodes only — it does not and cannot verify the token's signature, since that requires the issuer's secret or public key, which this tool never has access to. Never use a decoded-but-unverified token as proof of authenticity.
How it works
Paste a JWT. The tool splits it into its three dot-separated parts, decodes the base64url-encoded header and payload as JSON, and reports the algorithm along with issued-at and expiry timestamps if those claims are present.
- Enter jWT.
- Click Calculate to see your results.
Examples
Decoding a standard token
A token with header {"alg":"HS256","typ":"JWT"} and a payload containing "sub" and "iat" claims decodes to readable JSON for both parts.
Who should use it
- Debugging why an API request is being rejected by inspecting the token's claims.
- Checking a token's expiry or issuer during development.
Industry applications
- Software development and API debugging
- Authentication and identity systems
Advantages
- Instantly decodes both header and payload without needing any secret key.
- Flags expiry status automatically when an "exp" claim is present.
Limitations
- Cannot verify the token's signature — decoding and verification are different operations.
- Anyone who has a JWT can already read its header and payload; this tool does not add security.
Common mistakes to avoid
- Treating a successfully decoded token as proof that it's authentic or hasn't been tampered with — decoding never verifies a signature.
- Pasting tokens containing sensitive production data into any online tool as a general habit.
Best practices
- Use this tool for debugging and inspection only; verify signatures using your backend's JWT library with the actual signing secret or public key.
Tips
- If you need to verify a token's signature (not just read its contents), use your backend framework's JWT library with the actual secret or public key — this tool intentionally doesn't do that.