JWT Decoder Free Online Tool

Decode and inspect JWT tokens. Header, payload, and signature. Free, no signup required. Use it right in your browser.

About this tool

What it does, limits, use cases, tips, and answers to common questions.

Overview

JWTs are three Base64URL segments: header, payload, signature. This decoder shows the JSON claims so you can debug "why is this token expired" without writing a script.

It does not verify the signature against your secret or JWKS by default. Anyone can mint a JWT with fake claims; decoding is not authentication. Never paste a live production refresh token into a public decoder that logs. This one runs locally, which is the point.

Look at exp, nbf, aud, and iss. Clock skew and the wrong audience are the usual outages.

Limitations

  • Decoding is not verification.

  • Encrypted JWTs (JWE) are not the same as signed JWTs (JWS).

  • Do not share production tokens in screenshots.

Common Use Cases

  • Debugging 401s from an API.

  • Confirming roles inside a claim.

  • Teaching how JWTs are structured.

Pro Tips

  • If the token has five segments, you are looking at JWE. This debugger is for compact JWS.

Frequently Asked Questions

Can it crack the signature?

No, and you should not try. Use your real verifier with the real key.

Why is payload readable?

Because it is encoded, not encrypted, unless you used JWE.

Home · All Tools · Features · About Us