JWT Decoder

Decode JWT tokens online to read the header, payload and expiry claims — free JWT decoder.

This decodes the token only. The signature is not verified, so never trust a token here for authentication decisions.

About

About the JWT Decoder

Decodes a JWT's header and payload into readable JSON and summarizes its key claims, without verifying the signature.

Backend developers use it to inspect what claims a token actually carries while debugging an auth flow, and API integrators use it to check an access token's expiry without writing any code. It's one of many free developer tools on Toolapt, and like every tool here, it's free to use with no sign-up and no limit on how many times you run it.

Choose what to view about this tool

Guide

Using the JWT Decoder

  1. 1

    Step 1

    Paste the JWT into the Token field — a leading "Bearer " prefix is stripped automatically.

  2. 2

    Step 2

    Click "Decode token".

  3. 3

    Step 3

    Read the decoded header and payload, plus the summarized claims below.

  4. 4

    Step 4

    Click "Copy payload" to copy just the payload JSON, or "Clear" to start over.

  • Decodes both the header and payload of any standard JWT
  • Summarizes key claims: algorithm, type, subject, issuer, issued-at, not-before and expiry
  • Shows whether the token has already expired, based on its exp claim
  • Strips a leading "Bearer " prefix automatically if you paste a full Authorization header value
  • One click to copy just the decoded payload
  • Works entirely in your browser — the token you paste is never sent to a server
  • Free to use, with no sign-up and no limit on how many times you run it

Backend developers

Backend developers use the JWT Decoder for inspecting exactly which claims a token carries while debugging an authentication or authorization flow.

API integrators

API integrators use the JWT Decoder for checking an access token's expiry time without writing any decoding code themselves.

QA engineers

QA engineers use the JWT Decoder for confirming that a token issued by a test environment contains the expected subject and claims.

Students learning auth

Students learning auth use the JWT Decoder for seeing how a JWT's three parts — header, payload and signature — actually look once decoded.

Examples

JWT Decoder examples

4 worked examples

01

Classic sample token

Paste the well-known sample token starting eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIi4uLg and it decodes to alg HS256, sub 1234567890, name "John Doe" and iat 1516239022.

02

Bearer prefix stripped

Paste a full Authorization header value like "Bearer eyJhbGciOi..." and the leading "Bearer " is stripped automatically before decoding, so it decodes normally.

03

Expired token

Paste a token whose payload has an exp claim set in the past, and the summary clearly marks it Expired, showing the exact date and time it expired.

04

No expiry claim

Paste a token whose payload has no exp field at all, and the summary simply notes there's no expiry claim to check.

Related tools

JWT Encoder

Build and sign a JSON Web Token from a header, payload and secret.

Use it

Regex Tester

Test a regular expression against sample text and inspect every match and group.

Use it

Cron Expression Parser

List the next run times for a five-field cron schedule, in UTC.

Use it

HTTP Status Code Lookup

Look up what an HTTP status code means, or search the full list.

Use it

Code Beautifier

Auto-format messy JavaScript, HTML or CSS with consistent indentation.

Use it

Syntax Highlighter

Turn a code snippet into highlighted HTML you can paste into a blog post or page.

Use it

FAQ

Frequently asked questions

Quick answers to common questions about the JWT Decoder.

What does the JWT Decoder do?

It splits a JSON Web Token into its header and payload, decodes both to readable JSON, and summarizes common claims like expiry and issuer.

Is the JWT Decoder free to use?

Yes. It's free, with no sign-up, no watermark and no limit on how many times you use it.

Is my token safe when I use this tool?

Yes. Decoding happens entirely in your own browser — the token you paste is never sent to a server.

Does this tool verify the token's signature?

No. It only decodes the header and payload, which anyone can read without a secret key. It never checks the signature, so a decoded token here should never be trusted for an authentication decision.

What does the "Signature part" row mean?

It just tells you whether a third, signature segment is present in the string you pasted — not whether that signature is valid.

What if my token has expired?

The tool tells you it expired and shows the exact expiry date and time from the exp claim.

What if I paste a token with no expiry claim?

The tool decodes it normally and simply notes that it has no expiry claim.

Can I use the JWT Decoder on my phone?

Yes. The page is fully responsive and works on mobile, tablet and desktop browsers alike.

Still have a question? Contact us

Report a problem

JWT Decoder

What went wrong?
    or paste a screenshot