JWT Decoder
Inspect a JWT's header and payload — signature is not verified
Header
Payload
Claims
Note: Decoding only reads the token's contents — it does not verify the signature. A decoded token is not proof of authenticity. Everything runs locally in your browser.
JWT Decoder — Complete Guide & Instructions
MakeCard JWT Decoder splits a JSON Web Token into its readable header and payload the moment you paste it — no button press needed. It pretty-prints both JSON sections, lists every claim in a table, converts timestamps to readable dates, and flags whether the token is expired per its exp claim. Decoding happens locally, which makes it a safe way to inspect tokens during API and auth debugging.
How to Use JWT Decoder
- 1 Paste the full JWT (starting eyJhbGciOi…) into the token box — decoding is instant.
- 2 Check the status badge: “Token is EXPIRED” or “still valid (per exp claim)”.
- 3 Inspect the Header card for algorithm and token type.
- 4 Review the Payload card and the Claims table for iss, sub, exp and custom fields.
- 5 Use the “Copy” buttons to grab either section as pretty JSON.
Key Features & Capabilities
- Live decoding as you paste — no submit button.
- Separate Header and Payload cards with pretty-printed JSON and copy buttons.
- Claims table renders every payload key with human-readable timestamp values.
- Automatic expiry check against the exp claim with a clear badge.
- Local-only decoding — safe to inspect real production tokens.
Supported Formats & Specifications
| Parameter | Specification |
|---|---|
| Input | Compact JWS format — header.payload.signature (eyJ…) |
| Decoded | Header JSON, payload JSON, per-claim table |
| Expiry | Live badge based on the exp timestamp claim |
| Signature | Not verified — decoding only (as the tool states) |
| Processing | Fully client-side base64url decode |
Practical Everyday Use Cases
- Debugging authentication issues by checking which claims a server actually issued.
- Confirming a token's expiry time when sessions end unexpectedly.
- Inspecting aud, iss and scope values during OAuth integration work.
- Extracting a user ID or role from a token while building a frontend.
- Teaching how JWTs are structured — header, payload, signature.
Pro Tips for Best Results
- Decoding is not verification — the tool reads contents but does not check the signature, exactly as the on-page note warns.
- Never paste tokens into random online decoders; this one decodes locally, but treat tokens like passwords anyway.
- The claims table converts numeric timestamps — check exp, iat and nbf there first when debugging.
- A token can be expired yet still decode fine — expiry is a claim, not a structural failure.
Common Problems & Solutions
Make sure you pasted the whole compact token — three base64url segments separated by two dots. Truncated pastes are the usual cause.
The token may be encrypted (JWE) rather than signed (JWS) — JWE payloads are ciphertext and cannot be read by decoding.
The badge uses your local clock against the exp claim; a wrong system clock makes valid tokens appear expired or vice versa.
Privacy & Security
100% Client-Side Execution
Decoding is pure base64url parsing inside your browser — the token is never transmitted, logged or stored.
Frequently Asked Questions
Everything you need to know about using JWT Decoder
It depends where decoding happens — this tool decodes entirely in your browser, so the token never leaves your machine. Still treat tokens as secrets.
A header (algorithm and type), a payload of claims (issuer, subject, expiry, custom data) and a signature — this tool shows the first two plus a claims table.
No — decoding only reveals contents. Anyone can craft a token; only signature verification by the issuing server proves authenticity, which this tool deliberately does not perform.
Paste it and check the badge — it compares the exp claim timestamp against the current time and shows EXPIRED or still valid.
Related FreeToolsBazaar Tools
Ready to Use JWT Decoder?
100% free, browser-based, and private. No installation, registration, or file upload to external servers required.
Start Using JWT Decoder