JWT Decoder
Decode and inspect JSON Web Tokens instantly — view header, payload, and signature with expiry status, issuer, and claim explanations. Browser-only.
Header
Payload
Signature
Signature (Base64URL)
Disclaimer: Free tool provided “as is” by MonitorGiant. No warranty or liability for any data loss, security issues, or infrastructure problems arising from use of this tool. Results are for informational purposes only. · A Free Tool by MonitorGiant
What is JWT Decoder?
A JSON Web Token (JWT) is a compact, self-contained token format used to securely transmit claims between parties. A JWT has three Base64URL-encoded sections separated by dots: a header (algorithm and token type), a payload (claims such as user ID, roles, and expiry time), and a signature. This tool decodes and displays all three sections in a readable format, highlights expired tokens, and explains common claim names — without verifying the signature, since that requires the secret key.
How to use this tool
- 1 Paste a JWT string (starting with 'eyJ') into the input field.
- 2 The header, payload, and signature sections are decoded and displayed in separate panels immediately.
- 3 Check the expiry indicator — a red badge means the token's 'exp' claim is in the past.
- 4 Review standard claims: 'iss' (issuer), 'sub' (subject), 'aud' (audience), 'iat' (issued at), 'exp' (expires at).
- 5 Note: this tool does not verify the signature. To confirm a token is authentic, signature verification must happen server-side with the secret key.
When would you use this?
- Debugging an authentication flow where a user is being rejected — decoding the JWT lets you check whether the token is expired, missing required claims, or targeting the wrong audience.
- Understanding what claims an OAuth 2.0 access token or ID token contains before writing code that depends on them.
- Auditing JWTs in a legacy system to check which algorithm (alg) is being used — 'none' or HS256 with a weak secret are common security risks.
How JWT Decoder works
- 1
Paste your JWT
Copy a JWT from an Authorization header, cookie, or API response and paste it into the input box. The token is decoded instantly — no button needed.
- 2
Inspect header and payload
The Header tab shows the algorithm (alg) and token type. The Payload tab shows all claims with explanations for standard ones (iss, sub, exp, iat, aud, jti). Expiry is shown relative to now.
- 3
Check expiry and claims
The banner at the top tells you immediately if the token is expired, about to expire (within 5 minutes), or still valid. Never copy a token into an online tool you don't trust — this tool processes everything locally.
Wondering how to decode a JWT token online and inspect its payload? A JSON Web Token has three Base64URL-encoded sections separated by dots: the header (algorithm and token type), the payload (claims like sub, exp, iat, aud), and the signature. The payload is readable without the secret key, which is why this tool can decode it client-side instantly. Common debugging tasks include checking the exp claim to see if a token has expired, reading aud and iss to confirm the right identity provider issued it, and verifying custom claims like role or scope.
Comments & Feedback
Found a bug? Have a suggestion? We'd love to hear from you.
Related Tools
From the makers of this tool
Need deeper observability?
MonitorGiant tracks real-time AI performance, infrastructure health, and system reliability — far beyond what free utilities can show.