Debugging expired tokens
Before
User got logged out every 5 minutes
After
Decoded payload showed exp was 5 minutes from iat
Backend was issuing tokens with the wrong expiry. Decoded payload made it obvious.
All Tools
JWT Decoder – Inspect JSON Web Tokens Instantly
JWTs look encrypted but they're not — the header and payload are just Base64URL-encoded JSON. This tool splits the token and shows you what's inside. Useful when a token expires early, has the wrong issuer, or you need to check a custom claim.
100% free, no signup
This only decodes the token to read its contents — it does not verify the signature. Never paste a token from a system you don't trust.
Your files are processed in your browser and never uploaded to any server.
A note from me
I use this almost every week when debugging auth flows. My tip: this tool decodes only — it does not verify signatures. Never assume a token is valid just because the payload looks right. The signature is what proves authenticity, and that's a separate check your backend has to do. Also, JWTs are often long; if you're copying from a network tab, grab the whole thing — missing the last few characters will cause a parse error.
— Mirza Noman Baig
How to use this tool
- 1Paste the complete JWT token.
- 2See the decoded header and payload instantly.
- 3Check claims — expiration (exp), issuer (iss), subject (sub), and custom fields.
- 4If the token format is wrong, the tool shows an error.
Real results from testing
These are actual measurements from using this tool, not estimates.
Verifying a custom claim
Before
Feature flag wasn't working for a specific user
After
Decoded payload confirmed the role claim was missing
The token was issued before the user's role was updated. Backend fix, not frontend.
Checking the algorithm
Before
Token validation kept failing on the backend
After
Decoded header showed HS256 instead of the expected RS256
Wrong signing algorithm was configured on the identity provider. Caught it in 30 seconds.
JWT Decoder features
Decode header and payload
Splits the JWT and shows readable JSON for both sections.
View all claims
Issuer, subject, audience, expiry, and any custom claims.
Error detection
Flags malformed tokens with a clear message about what's missing.
Local processing only
Your token never gets uploaded. Safe for production tokens.
Frequently asked questions
Does it verify JWT signatures?+
No. It only decodes the header and payload. Signature verification has to happen on your backend, where you have the secret key.
Is my token uploaded anywhere?+
No. Everything runs in your browser. Your tokens never leave your device.
What if the token format is wrong?+
The tool shows an error. Valid JWTs have three parts separated by two dots.
Is decoding the same as decrypting?+
No. Decoding just reads Base64URL data. JWTs aren't encrypted by default — that's why the payload is visible.
Can I check expiry time?+
Yes. The exp claim is a Unix timestamp. The decoded output shows it as a number, and you can compare it to the current time.