Decode and verify JSON Web Tokens. View header, payload, and signature information. Check token expiration status. All processing happens locally in your browser.
Advertisement
Advertisement
Advertisement
JWT Token
Header (Algorithm)
Header will appear here
Payload (Data)
Payload will appear here
Signature
Signature will appear here (Base64 encoded)
Note: The signature is used to verify the token's authenticity. This tool cannot verify the signature without the secret key, but you can see its structure.
🛈Privacy Note: All JWT decoding happens locally in your browser. Your tokens are never sent to any server. This tool only decodes the Base64Url-encoded parts of the JWT for inspection purposes.
What the JWT Decoder Does and Why It Matters
The JWT Decoder splits a JSON Web Token into its three parts — header, payload, and signature — and shows the decoded header and claims in readable JSON. It also surfaces useful claims such as the issuer, subject, and expiry so you can see at a glance what a token asserts.
Developers reach for this constantly while debugging authentication: checking whether a token has expired, confirming which scopes it carries, or understanding why an API rejected a request. Decoding happens in the browser, so you can inspect a token without pasting it into an unknown online service.
How to Use JWT Decoder
Paste a JWT (the long dot-separated string) into the input field.
Review the decoded header to see the algorithm and token type.
Read the payload to inspect claims such as sub, scope, iat, and exp.
Check the expiry indicator to confirm whether the token is still valid.
Copy any decoded section you need for a bug report or ticket.
Clear the field afterwards, especially for tokens from real environments.
Supported Inputs and Limitations
Supported input
A standard JSON Web Token in header.payload.signature form
Tokens signed with common algorithms (HS*, RS*, ES*)
What you get
Decoded header JSON (algorithm and type)
Decoded payload JSON with all claims
Expiry status derived from the exp claim
Known limitations
Decoding is not verification: the tool reads the token but does not validate the signature without the signing key.
A decoded payload is not proof of authorisation or identity on its own.
Avoid pasting production access tokens; treat any real token as a live credential.
Privacy and Security
Tokens are decoded entirely in your browser; the value is not sent to NovaTools or any backend. Nothing is stored once you close the tab. Because a JWT can be an active credential, only decode tokens you are authorised to handle and clear them when you are finished.
Frequently Asked Questions
Does this verify the token signature?
No. It decodes the header and payload so you can read them, but verifying the signature requires the secret or public key and is intentionally not performed here. Decoding alone does not prove a token is genuine.
Is my token sent to a server?
No. Parsing happens locally in your browser, so the token never leaves your device. That is exactly why it is safer than many online decoders.
Why does a valid-looking token still get rejected by my API?
Common reasons include an expired exp claim, the wrong audience or issuer, a clock-skew problem, or a signature signed with a key the server does not trust. The decoded claims usually point to which one applies.
Decode and inspect JSON Web Tokens (JWT) with our free online tool. JWTs are commonly used for authentication and information exchange in modern web applications. This tool helps developers debug and verify JWT tokens by decoding the Base64Url-encoded header and payload sections.
How to Use
Paste your JWT token in the input field above.
Click Decode JWT to parse the token.
View the Header section to see the algorithm and token type.
View the Payload section to see the claims and data.
Check the expiration status indicator above the output sections.
Use the Copy buttons to copy decoded sections.
Click Load Sample to see an example JWT token.
Frequently Asked Questions
What is a JWT token?
JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and authorization in web applications. They consist of three parts: header, payload, and signature, separated by dots.
Can this tool verify JWT signatures?
This tool decodes the header and payload for inspection but cannot verify the signature without the secret key or public key. Signature verification requires the key that was used to sign the token, which should remain secret. You can see the signature structure, but validation requires server-side implementation.
What does the expiration check do?
The expiration check looks at the "exp" (expiration time) claim in the payload and compares it to the current time. If the token has expired, you'll see a warning. This is useful for debugging authentication issues related to expired tokens.
Is my JWT token safe when using this tool?
Yes. All processing happens entirely within your browser. Your JWT tokens are never transmitted to any server or stored anywhere. However, be cautious when handling JWTs in shared environments, as they may contain sensitive information.
What are common JWT claims?
Common JWT claims include: "sub" (subject/user ID), "iss" (issuer), "aud" (audience), "exp" (expiration time), "iat" (issued at), "nbf" (not before), and "jti" (JWT ID). Custom claims can also be added depending on the application's needs.
