NineClip Free Tools

JWT Decoder

Decode a JWT to read its header and payload — and see the expiry — right in your browser. An honest note: it decodes the token, it does not verify the signature.

Developer ToolsTrending● Free No upload Instant

Loading JWT Decoder…

Your browser is preparing the tool. It runs 100% locally.

Quick Answer

Paste a JWT and the tool splits it into its parts, decodes the header and payload from Base64URL, and shows them as readable JSON, plus the expiry if the token has one. Two honest points: a JWT payload is only encoded, not encrypted, so anyone can read it; and this tool decodes but does not verify the signature, so it shows what a token claims, not whether it is authentic. It runs entirely in your browser; nothing is uploaded.

What the JWT Decoder Does

This tool takes a JSON Web Token — the kind used for login sessions and API authorisation — and reveals what is inside it. It decodes the header (which names the algorithm and token type) and the payload (the claims, such as the subject, issue time and expiry) into readable JSON.

It is the quick way to inspect a token: to see who it is for, what it grants, and when it expires, while debugging an authentication flow or checking a token you have been handed.

How It Works

A JWT is three Base64URL-encoded parts separated by dots: the header, the payload and the signature. The tool splits on the dots, decodes the first two parts back into JSON, and pretty-prints them. If the payload has an expiry claim, it converts that timestamp into a readable date.

It deliberately stops there. The signature — the third part — is what proves the token has not been tampered with and came from someone holding the key. Verifying it requires that secret or public key, which this tool does not have, so it reads the token without vouching for it.

Data source & conversion logic

  1. Split the token. Separate the JWT into its header, payload and signature parts at the dots.
  2. Decode from Base64URL. Decode the header and payload parts back into JSON text.
  3. Show the claims. Pretty-print the header and payload so the claims are readable.
  4. Read the expiry. If an expiry claim is present, convert its timestamp to a readable date.

JWT structure

header . payload . signature (three Base64URL parts, joined by dots) decode part 1 and part 2 back into JSON · the signature is not checked
Worked example
header {"alg":"HS256","typ":"JWT"} payload {"sub":"123","name":"Jane","exp":1735689600}

The header and payload are encoded, not encrypted — anyone can read them. The signature proves integrity, but verifying it needs the key, which this tool does not check.

Privacy

Your token is decoded entirely on your device, with no network request, so nothing is uploaded.

This matters for tokens. A live JWT can grant access, so you should never paste a real one into a site you do not trust. Here the decoding is local, but treat any working token as a secret regardless.

Nothing persists between sessions — close the tab and the token and its decoded contents are gone.

Standards & references

  • JWT (RFC 7519) — A JSON Web Token encodes claims as a JSON payload, signed (and optionally encrypted) and packaged as three Base64URL parts. It is widely used for authentication and authorisation.
  • Encoded, not encrypted — The header and payload of a standard signed JWT are only Base64URL-encoded. Anyone holding the token can decode and read them, so secrets must never be placed in a JWT payload.
  • Signature and verification — The signature protects integrity and authenticity, computed over the header and payload with the algorithm in the header. Verifying it requires the secret (HMAC) or public key (RSA, ECDSA) — which decoding alone does not do.

Accuracy & Limitations

The decoding is exact: it shows the genuine contents of the header and payload as they are encoded in the token, so it is reliable for inspecting what a JWT claims.

It does not verify the signature. Because it has no key, it cannot tell you whether the token is authentic, untampered or issued by who it claims — it only reads the contents. A valid-looking payload is not proof of a valid token.

It reads but does not enforce claims. It will show an expiry date, but it does not reject an expired token or check the issuer or audience — that is the job of the server that consumes the token. Treat the displayed expiry as information, not a verdict.

A JWT payload is not private. Since it is only encoded, anyone with the token can read every claim. If you see sensitive data in a payload, that is a design problem with the token, not something this tool exposes — it was always readable.

Real-World Use Cases

Debugging authentication

Inspect a token's claims while troubleshooting a login or API flow.

Checking expiry

See when a token was issued and when it expires.

Reading the claims

Confirm the subject, scopes or roles a token carries.

Learning about JWTs

See the header and payload structure of a real token.

When to use it — and when not to

Good for

  • Reading a JWT's header and payload
  • Checking a token's expiry and claims
  • Debugging an auth or API integration
  • Learning how JWTs are structured

Not the best choice for

  • Verifying a token is authentic or valid
  • Trusting a token without the signing key
  • Putting secrets in a payload (never do this)
  • Enforcing expiry or issuer rules

To verify a token, your server checks the signature with the signing key and validates the claims — use a JWT library for that, not a decoder. To protect sensitive data, encrypt it rather than placing it in a readable JWT payload.

Frequently Asked Questions

Does this verify the JWT signature?
No. It decodes the header and payload so you can read them, but it does not check the signature. Verifying authenticity requires the signing key, which a decoder does not have. It shows what a token claims, not whether it is genuine.
Is a JWT payload encrypted?
No. In a standard signed JWT, the header and payload are only Base64URL-encoded, so anyone with the token can read them. Never put passwords or secrets in a payload — they are effectively public.
What are the three parts of a JWT?
The header (algorithm and token type), the payload (the claims), and the signature — each Base64URL-encoded and joined by dots. This tool decodes the first two; the signature secures the rest.
How does it show the expiry?
If the payload has an expiry claim, the tool converts that numeric timestamp into a readable date. It displays the expiry for your information; it does not reject the token if it has passed.
Is it safe to paste a real token here?
The decoding happens entirely in your browser, so nothing is uploaded. Even so, a live token can grant access, so treat it as a secret and avoid pasting real tokens into any site you do not trust.
Why can anyone read my JWT?
Because the payload is encoded, not encrypted. Encoding only changes the representation; it does not hide the data. That is by design — a signed JWT protects integrity, not confidentiality.
What does the algorithm in the header mean?
It names how the signature is computed, such as HMAC SHA-256 or RSA. The server uses that algorithm with its key to verify the token. Beware of a token claiming an algorithm of none, which is a known attack.
Can I trust the claims I see?
Only after the server verifies the signature. The decoded claims are what the token says, but without checking the signature you cannot be sure they were not altered. Decoding is for inspection, not trust.
What are common JWT claims?
Standard ones include sub (subject), iss (issuer), aud (audience), iat (issued-at), exp (expiry) and nbf (not-before). Tokens also carry custom claims like roles or scopes.
What is the difference between a JWT and a session cookie?
A JWT is self-contained — its claims travel inside the token — whereas a session cookie is usually an opaque ID the server looks up. Both identify a user, but a JWT carries readable data and is verified by signature.
Is my token uploaded anywhere?
No. It is decoded entirely in your browser. Nothing is sent to a server, so the token stays on your device.
Can a JWT be encrypted instead of just signed?
Yes. The JSON Web Encryption form encrypts the payload so it cannot be read. Most JWTs in the wild are signed-only, though, which is why their payloads are readable — as this tool shows.

References

Base64URL-decodes the header and payload and shows the expiry; honest that it only decodes — it does not verify the signature, and a JWT payload is readable by anyone, not encrypted.

PopularHot

JSON Formatter

JSON Formatter for developers — instant, offline-style and privacy-safe.

DeveloperOpen Tool
Popular

JSON Validator

JSON Validator for developers — instant, offline-style and privacy-safe.

DeveloperOpen Tool
Popular

Base64 Encoder

Base64 Encoder for developers — instant, offline-style and privacy-safe.

DeveloperOpen Tool
Popular

Hash Generator

Fast, free Hash Generator that runs entirely client-side in your browser.

DeveloperOpen Tool
Popular

UUID Generator

Fast, free UUID Generator that runs entirely client-side in your browser.

DeveloperOpen Tool
Trending

CSS Minifier

Fast, free CSS Minifier that runs entirely client-side in your browser.

DeveloperOpen Tool

Ready to try the JWT Decoder?

It is free, private and runs entirely in your browser — no sign-up, no uploads, no limits.

Use the tool now Explore Developer Tools