Decode and inspect JSON Web Tokens instantly in your browser
JSON Web Tokens are the standard way modern applications prove who you are after login. When you sign in, the server issues a compact signed token; your browser or app then presents it with every request instead of re-sending credentials. Each token has three parts: a header naming the signing algorithm, a payload carrying the claims — user identifiers, roles, expiry times — and a signature that lets the server detect tampering.
The detail that surprises people: the header and payload are merely base64-encoded, not encrypted. Anyone holding a token can read everything inside it in milliseconds — which is precisely what this decoder does. The signature prevents modification, because it is computed with a secret only the server knows, but it hides nothing. This is why tokens should never carry sensitive personal data, and why decoding your own tokens to see what they contain is a legitimate and instructive exercise.
For developers, decoding is everyday debugging: is the token expired, does it carry the expected roles, is the audience claim right, which algorithm signed it? Pasting production tokens into a random web decoder is a genuine security risk, since a live token is a working credential for someone’s account. This decoder runs entirely in your browser — the token is never transmitted, making it the safe way to inspect real tokens.
Yes — decoding happens locally in your browser and the token is never sent anywhere, unlike many online decoders that process tokens server-side. Still, treat live tokens like passwords in general: this tool is designed exactly so they need not leave your machine to be inspected.
Because JWTs are encoded for transport, not encrypted for secrecy. Base64url encoding is trivially reversible by design. The cryptographic protection is the signature, which prevents anyone from altering the token without the server’s secret — but reading it requires nothing.
No — signature verification requires the secret or public key held by the issuing server, which you would never share with a website. This tool decodes and inspects content; whether the signature is authentic is for the server holding the key to determine.
iss identifies who issued the token, sub the account it belongs to, aud the intended recipient service, exp when it expires, iat when it was issued, and nbf the earliest moment it becomes valid. Times are Unix timestamps — this decoder translates the expiry into a clear valid-or-expired verdict.
The exp timestamp has passed, so servers will reject it. Applications normally obtain a fresh token by logging in again or using a refresh token behind the scenes. If your app fails with an expired token, the refresh flow is the first place to look.