Free JWT Decoder
Paste a JSON Web Token to decode the header, payload, and signature. Shows algorithm, expiry, and current validity. 100% client-side — your tokens are never transmitted anywhere.
Frequently asked questions
Are my JWT tokens sent to your server?
No. Decoding happens entirely in your browser using built-in base64 functions. Nothing is uploaded, logged, or transmitted. It is safe to paste production tokens.
Can this verify the signature?
This decoder shows the signature but does not cryptographically verify it. Signature verification requires the secret (for HMAC) or public key (for RSA/ECDSA), which you should never paste into a public tool. Verify on your server or with a CLI like jwt.io with your secret stored locally.
How do I check if a token is expired?
The decoder converts the 'exp' claim from Unix timestamp to a human-readable date and shows whether the token is currently expired. Also shows 'iat' (issued at) and 'nbf' (not before).
What's the difference between JWT and a session cookie?
Session cookies store an opaque ID; the server looks up state. JWTs are self-contained — the user data lives inside the token, signed by the server. JWTs are stateless and scalable but cannot be revoked without extra infrastructure like a deny-list.
More developer tools
Decode any JWT instantly — header, payload, signature. Adds AI security audit that flags weak claims (alg=none, missing exp, sensitive data) and gives token-specific best practices.
How to use
- 1Paste a JWT (the 3-segment 'eyJ...' string).
- 2Header and payload decode automatically — claims are explained.
- 3Token validity (exp / nbf) checked against current time.
- 4Click 'Audit this token' for AI security review.
- 5Never paste production secrets — JWT verification needs the secret key.
Why use this tool
- Decoding is fully local — JWT never leaves your browser.
- AI audit catches real production misconfigurations (alg=none, long expiry, sensitive data).
- Best practices generated for THIS specific token, not generic advice.
Real-world examples
Debug an auth flow
Paste session JWT → see claims (sub, iat, exp), confirm token isn't expired, check audience / issuer match.
Security audit
AI flags 'alg: none' as critical, missing 'exp' as high risk, and a leaked 'password' claim in payload as critical.
Learn JWT structure
Beginners see how header + payload + signature work — every claim explained in plain English.