Skip to content

JWT Decoder – Inspect Header, Payload & Claims

Decode JWTs online for free with ToolGuru. Inspect the header, payload, and signature of a JSON Web Token in your browser. Decoding does not verify the signature.

This tool decodes the JWT header and payload. Decoding does not verify the token's signature.

🔒 Your data is processed in your browser and is not uploaded to our server.

JWT decoder online

Paste a JSON Web Token to inspect the header and payload. This JWT inspector Base64URL-decodes each segment in your browser. It is a decoder, not a verification service — a readable payload does not mean the token is authentic.

Header, payload, and signature

A JWT is three segments: header.payload.signature. The header usually names the algorithm and type. The payload holds claims. The signature is shown as encoded text so you can compare it, but ToolGuru does not check it against a secret or public key.

Expiration and other claims

If the payload includes exp, you will see the Unix timestamp, an ISO date, and whether that time has passed. iss, sub, aud, iat, nbf, and jti are listed the same way. Treat these as a reading aid, not a security decision.

Related developer tools

Pretty-print payload JSON in the JSON Formatter, convert related strings with the Base64 Encoder / Decoder, or mint test IDs with the UUID Generator.

How to Decode a JWT

  1. Step 1

    Paste the JWT

    A JSON Web Token has three segments: header.payload.signature. Paste the full token into the input.

  2. Step 2

    Decode locally

    The header and payload are Base64URL-decoded and shown as JSON. The signature is displayed as encoded text and is not verified.

  3. Step 3

    Read claims

    If the payload includes exp, you will see the expiration timestamp and whether that time has passed — as information only, not a validity check.

Frequently Asked Questions

What is a JWT decoder?

A JWT decoder (or JWT inspector) reads the header and payload of a JSON Web Token so you can see claims such as issuer, subject, and expiry. It does not prove the token is authentic.

Does this tool verify the JWT signature?

No. This tool decodes the JWT header and payload. Decoding does not verify the token's signature. Do not treat a decoded token as valid.

Is it safe to paste a JWT here?

Decoding runs in your browser and is not uploaded to our server. Still, avoid pasting production secrets or tokens you would not share in a local editor.

What does exp mean in a JWT?

exp is the expiration time as a Unix timestamp. ToolGuru shows the date and whether that time has already passed. That is informational only — signature verification is still required to trust the token.

Why did my token fail to decode?

Common causes are a missing segment, invalid Base64URL, or payload JSON that is not an object. The error message describes which part failed.

Is the JWT decoder free?

Yes. Decode tokens without an account or payment.

Related tools

Developer Tools

JSON Formatter

Format, validate, beautify, and minify JSON in your browser.

Developer Tools

Base64 Encoder / Decoder

Encode text to Base64 or decode Base64 back to text.

Developer Tools

URL Encoder / Decoder

Encode or decode URL strings and query parameters.

Developer Tools

UUID Generator

Generate random UUID v4 identifiers in your browser.

Developer Tools

QR Code Generator

Create a QR code from a URL or plain text and download it.