Free Online JWT Decoder

What the JWT Decoder does

The JWT Decoder splits a JSON Web Token into its three parts and shows the header and payload as readable JSON. The header shows the signing algorithm, such as HS256. The payload contains the claims, such as sub, iat and exp.

It only decodes the token and does not verify the signature. A decoded token tells you what it claims, not whether those claims can be trusted. Verification needs the secret or public key and must happen in your own backend.

When to use it

• Debugging a 401 or 403 error: check whether the token has expired, or whether it carries the audience, issuer or roles you expect.
• Checking what an identity provider actually puts into its tokens.
• Reading the iat (issued at) and exp (expires) times. They are Unix timestamps in seconds, which the Timestamp Converter turns into dates.

Worked example

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFuYSIsImlhdCI6MTc2NzIyNTYwMCwiZXhwIjoxNzY3MjI5MjAwfQ.sig_placeholder

Output

{
  "Header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "Payload": {
    "sub": "1234567890",
    "name": "Ana",
    "iat": 1767225600,
    "exp": 1767229200
  },
  "Signature": "sig_placeholder"
}

Common questions about the JWT Decoder