The free JWT Decoder
Paste any JSON Web Token and instantly see its decoded header, payload and signature, color-coded for clarity, with no server round-trip — decoding happens entirely in your browser using
- Free to use
- No signup
- Nothing to install
- Works in any modern browser
A token with payload {"sub":"1234567890","name":"Ana","exp":1735689600} decodes to show the header algorithm (e.g. HS256), the claims above, and a status flag showing whether the exp timestamp has already passed.
Open the JWT Decoder
Illustration. Open the tool for the real thing.
What is the JWT Decoder?
Paste any JSON Web Token and instantly see its decoded header, payload and signature, color-coded for clarity, with no server round-trip — decoding happens entirely in your browser using JavaScript, so the token never leaves your device.
It automatically detects and highlights expired, active and not-yet-valid tokens by reading the exp, iat and nbf claims, and can attempt signature verification: HS256/384/512 tokens verify client-side with a secret key you provide, while RS256/ES256 tokens can be checked against a public key in PEM format.
3 steps to your result
Open the tool and follow along. Nothing to install.
What you get
Header and payload decode as you type — nothing is sent to any server.
Automatically flags expired, active and not-yet-valid tokens based on exp/iat/nbf.
Verify HS256/384/512 signatures with a secret key, right in the browser via the Web Crypto API.
Header, payload and signature are visually separated for quick scanning.
AZRS tools are free to open and use.
It opens in your browser, so there is nothing to download.
Used for
Pick one to see how it fits.
Developers
Debug authentication issues by inspecting exactly what claims a token carries.
Try it freeAPI testers & QA engineers
Verify a token's expiry and claims before using it in a test request.
Try it freeStudents learning web auth
See how a JWT's three Base64URL-encoded parts (header, payload, signature) fit together.
Try it freeHow it compares
A plain look at this tool next to the usual alternative.
| This utility | Desktop software | |
|---|---|---|
| Install | Nothing to install | Usually an app or program to install |
| Account | No signup | Depends on the product |
| Cost | Free to use | Free or paid, depends on the product |
Questions people ask
Is it safe to paste my JWT here?
Yes. This tool decodes entirely in your browser using JavaScript; your token is never sent to any server, which you can confirm using the browser's Network tab.
What is a JWT?
A JSON Web Token is a compact, URL-safe format for representing claims between parties, made of three Base64URL-encoded parts: a header, a payload and a signature.
Can this tool verify the signature?
For HS256/384/512 tokens, enter your secret key and it verifies client-side. For RS256/ES256, paste the public key in PEM format to attempt verification.
What do exp, iat and nbf mean?
exp is the expiration timestamp, iat is when the token was issued, and nbf is the earliest time the token should be accepted — all converted to readable dates automatically.
What's the difference between HS256 and RS256?
HS256 uses one shared secret for signing and verifying; RS256 uses a private key to sign and a separate public key to verify, common in distributed systems.
More free tools
Related to the JWT Decoder.
Try the JWT Decoder now
Paste any JSON Web Token and instantly see its decoded header, payload and signature. Free to use.
Try it free