JWT Decoder
Decode JSON Web Tokens (JWT) instantly with this free client-side JWT decoder. View the header, payload, signature, and token claims securely in your browser.
Loading tool…
What is a JWT?
A JSON Web Token is a compact, URL-safe credential defined in RFC 7519. It has three parts separated by dots: a header saying which algorithm signed it, a payload of claims such as the subject, issuer, audience, and expiry, and a signature. The first two parts are Base64URL-encoded JSON — encoded, not encrypted. Anyone holding the token can read everything inside it.
That last point is the one that catches people out. The signature does not hide the contents; it proves the token has not been altered and was issued by someone holding the signing key. Decoding a JWT therefore requires no secret at all, while verifying one requires the key. Put nothing in a JWT payload that you would not be comfortable showing to the bearer, because they can read it in a second.
Why we built this tool
Debugging authentication means reading tokens: checking whether exp has passed, whether the roles claim contains what the gateway expects, whether the audience matches, or why one service accepts a token another rejects.
Those are live session tokens. Pasting one into a website means transmitting a working credential to a third party — if it has not expired, whoever receives it can use it. That is the single strongest argument for a client-side tool, and it is why ours decodes purely in your browser: the split, the Base64URL decode, and the JSON parse all happen in your tab, with no network request. The token is never sent anywhere. Even so, treat any token you have pasted anywhere as worth rotating.
Tips and common mistakes
- Decoding proves nothing about validity — only the signing key can verify a token.
- Times in
exp,iat, andnbfare Unix seconds, not milliseconds; a thousandfold error makes a token look valid until the year 56000. - Clock skew between servers is a frequent cause of a token being rejected as expired or not-yet-valid.
- Rotate any token you have pasted anywhere, and never share a live one in a ticket or chat.
Open JWT Decoder with a link
JWT Decoder can be handed its input by the link that opens it, so the page arrives with the work already done. This is meant for assistants and scripts: if a chatbot, an editor extension, or a command-line agent already holds your content, it can build a link instead of asking you to copy and paste into a box.
The payload rides in the fragment — the part of a URL after the #. Browsers never send the fragment to a server, so anything handed over this way stays on your device exactly as a dropped file would. A link that uses the query string instead is rewritten into the fragment by the page before any analytics or ad script can read the address.
Prefix any field with gz — #gztext= — to pass it as gzip-compressed base64url, which fits roughly five to ten times more into the same link. Links stay reliable up to about 8,000 characters; past that, chat apps and address bars start truncating them, and the page says so rather than loading half a document.
One exception to the privacy rule: ?url= tells the page to download the input from an address. That request goes from your browser straight to that server — not through ours — but it does leave your device, and it only works if the server allows cross-origin requests.
#text=— the text to work on
Example: https://mygadgets.ink/tools/jwt-decoder/#text=...
Quick start: using JWT Decoder
- Paste the token into the input above — the whole string, including both dots.
- Read the decoded header to see the signing algorithm.
- Read the payload claims, starting with
exp,iat,iss, andaud. - Compare those against what the rejecting service expects.
- Remember that decoding is not verification; only the signing key can prove the token is genuine.
For raw encoding work, see Base64 Encoder/Decoder, and Timestamp Converter turns the numeric exp claim into a readable date.