Is it safe to paste my JWT token into an online decoder?

This is a client-side JWT decoder — your token is decoded entirely in your browser using JavaScript. It is never uploaded to any server. However, JWTs often carry sensitive claims such as user IDs, roles and emails. As a best practice, avoid pasting production access tokens into any online tool. Use this tool for debugging tokens in non-production environments.

What is the exp claim in a JWT?

The exp (expiration) claim is a Unix timestamp that specifies when the JWT expires. This decoder shows the human-readable date and time for exp, iat (issued at) and nbf (not before) claims, and calculates whether the token is still valid, expired, or how much time remains before expiry.

JWT Decoder Online Free

The fastest online JWT decoder — paste any JSON Web Token and instantly decode JWT header, payload and claims. Check expiration, issuer and all standard claims. Our client-side JWT decoder runs entirely in your browser. No uploads, no account, 100% private.
JWT Decoder · Claims Inspector · Expiry Check · Signature Verify · Free

JWT Token

HeaderJOSE

PayloadClaims

SignatureBase64URL

🔑 Verify Signature (optional)

How It Works

1. Paste JWT Token

Paste your JWT — from an API response, Authorization header or OAuth flow — into the input above.

2. Decode Locally

Click Decode JWT. Header and payload are Base64URL-decoded in your browser. No server contact.

3. Inspect Claims

View all claims — sub, iss, exp, iat and custom claims — with human-readable timestamps.

4. Verify Signature

Optionally verify using your HMAC secret or RSA public key — the panel matches the hash to the token's own algorithm automatically.

What Is a JWT Decoder?

A JWT decoder is a tool that reads a JSON Web Token and splits it into its three components — header, payload and signature — then decodes the Base64URL-encoded header and payload into readable JSON. This lets you inspect the algorithm, token type, issuer, subject, audience, expiration time and any custom claims without needing the secret key.

This online JWT decoder also acts as a JWT claims inspector and expiry checker — it calculates whether the token is still valid, how much time remains before it expires, or how long ago it expired. It flags a token that uses the insecure alg: none, and optionally verifies the signature entirely in your browser using the Web Crypto API.

JWT Token Structure

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiaWF0IjoxNjAwMDAwMDAwLCJleHAiOjE5MDAwMDAwMDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

│ Header      — algorithm (alg) and token type (typ)
│ Payload     — claims: sub, name, iat, exp, custom fields
│ Signature   — HMAC or RSA signature for verification

Standard JWT Claims

Claim	Full Name	Description
sub	Subject	The user or entity the token refers to (e.g. user ID)
iss	Issuer	The server or service that issued the token
aud	Audience	The intended recipient(s) of the token
exp	Expiration	Unix timestamp after which the token is invalid
iat	Issued At	Unix timestamp when the token was issued
nbf	Not Before	Unix timestamp before which the token must not be used
jti	JWT ID	Unique identifier for the token (for revocation)

How to Decode JWT and View Claims

This JWT decode tool supports all standard JWT formats. Here's how to use each feature:

Decode JWT Token Online

Paste your JWT (the three-part dot-separated string) into the input field and click Decode JWT. The token is split and decoded instantly. The colour-coded preview under the input shows the header in red, payload in purple and signature in green.

JWT Decoder Check Expiration (exp)

The status banner at the top of the results shows whether the token is Valid, Expired, or has no expiry claim. For each timestamp claim (exp, iat, nbf), the decoder shows both the raw Unix timestamp and a human-readable date with the time remaining or elapsed.

JWT Signature Verifier

The Verify Signature panel automatically selects the correct tab and hash based on the token's own alg claim once you decode it. For the HMAC family (HS256, HS384, HS512), paste your secret key. For the RSA family (RS256, RS384, RS512), paste the public key in PEM format — only the public key is needed, the private key never needs to leave your server. If the token uses an algorithm outside these two families, the panel tells you so rather than silently attempting the wrong check.

Bearer Token Decoder for OAuth

This tool works as a bearer token decoder for OAuth 2.0 access tokens and OpenID Connect ID tokens. If your API returns a Bearer token in the Authorization header, paste just the token string (without the Bearer prefix) to inspect the user claims, scopes, and expiration time.

Who Uses a JWT Decoder?

This JWT decoder for developers is used across authentication, API development and security workflows:

API developers: Inspect access tokens returned by OAuth 2.0 authorization servers to verify the claims, scopes and expiration before using them in API calls.
Frontend developers: Decode the JWT stored in localStorage or cookies to read user identity, roles and expiration without making an extra API call.
Backend developers: Debug authentication middleware by pasting failing tokens to check whether the issue is expiry, wrong audience or missing claims.
Security engineers: Inspect JWTs in penetration tests and security audits — this decoder actively flags alg: none tokens, and helps spot overly permissive claims or excessively long expiry times.
DevOps engineers: Decode service account tokens in Kubernetes (kubectl get secret) and cloud provider tokens (AWS STS, GCP service accounts) to verify scope and expiry.

Frequently Asked Questions

What is a JWT decoder?

A JWT decoder splits a JSON Web Token into its header, payload and signature, then Base64URL-decodes the header and payload into readable JSON. It lets you inspect algorithm, token type, user claims, roles, expiry and any custom fields without the secret key. Decoding does not verify the signature — that requires the secret or public key.

How do I decode a JWT token online?

Paste your JWT (the three-part dot-separated string starting with eyJ) into the input above and click Decode JWT. The header, payload and signature are decoded and displayed instantly with human-readable timestamps for exp, iat and nbf. All decoding happens locally — the token never leaves your browser.

Is it safe to paste my JWT token here?

This is a client-side JWT decoder — your token is decoded entirely in your browser and never sent to any server. However, JWTs carry sensitive user data. As a best practice, avoid pasting production tokens that grant sensitive permissions. Use this tool for development and debugging tokens in non-production environments.

Can this tool verify the JWT signature?

Yes, for two algorithm families. HMAC (HS256, HS384, HS512) using a shared secret key, and RSA (RS256, RS384, RS512) using a public key in PEM format — the Web Crypto API automatically uses the matching hash for whichever variant your token declares. For HMAC, paste your secret. For RSA, paste the public key only. Tokens using other algorithms, such as ES256 or alg:none, can't be verified in this panel.

What does it mean if a token uses alg:none?

alg: none means the token has no cryptographic signature at all — anyone can create or modify a token like this and it will look structurally valid. A server that accepts alg:none tokens can be trivially bypassed; this is a well-documented JWT vulnerability class. This decoder shows a clear warning whenever it detects one.

What does the exp claim mean in a JWT?

The exp (expiration) claim is a Unix timestamp (seconds since January 1, 1970 UTC). The JWT must not be accepted after this time. This decoder converts it to a human-readable date and shows whether the token is still valid, when it expires, or how long ago it expired.