Decode JWT header and payload locally. No token leaves your browser.
A JWT has three parts: header.payload.signature. Paste your JWT to decode the base64 header and payload, check expiry, and inspect claims — all locally in your browser.
FreeToolHub JWT Decoder is a free browser-based tool that decodes JWT tokens to inspect header and payload, no signup, no upload.
⚠️ Decoding runs 100% locally in your browser — your JWT is never uploaded. Never paste production access tokens or sensitive credentials into any online tool. This decoder only reads the header and payload; it does NOT verify signatures and must not be used to trust token contents.
About this tool
Decode and debug JWT tokens locally. No tracking, no server, 100% in-browser. Free.
What Is the JWT Decoder?
The JWT Decoder is a free browser-based tool that parses JSON Web Tokens into their three components — header, payload, and signature — without sending the token to any server. It detects the signing algorithm (HS256, HS384, HS512, RS256, ES256), converts Unix timestamps (iat, exp, nbf) to human-readable dates, and flags expired tokens with a red warning. The decoder handles URL-safe Base64 encoding automatically and displays the raw vs. decoded JSON side by side. Unlike jwt.io, your token never leaves your machine, making it safe for debugging production tokens containing PII or session secrets.
Who Should Use the JWT Decoder?
Backend developers debugging authentication flows use this tool daily to inspect token claims, verify expiration windows, and confirm custom claims (roles, permissions, tenant IDs) are correctly embedded. Frontend developers use it to diagnose why a session expired unexpectedly or why an API returns 401. Security engineers audit token payloads for sensitive data leakage (passwords, internal IDs). QA testers validate that token refresh logic produces correct iat/exp intervals. It is also useful for students learning OAuth 2.0 and OpenID Connect flows who need to visualize what is inside an ID token.
How to Use the JWT Decoder
Paste your JWT string (the full eyJhbG... token) into the input field. The tool instantly decodes all three parts: the header shows the algorithm and token type, the payload displays all registered claims (iss, sub, aud, exp, iat) plus any custom claims, and the signature section shows the encoded signature. Expired tokens show a red "EXPIRED" badge with the exact expiration time. Click any timestamp to toggle between Unix epoch and ISO 8601 format. Copy individual claims with one click. No "Decode" button needed — parsing happens on every keystroke.
Frequently asked
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It consists of three Base64URL-encoded parts separated by dots: header.payload.signature. JWTs are widely used for authentication and information exchange — when you log into a web app, the server typically returns a JWT that your browser sends with every subsequent request to prove your identity.
Is my JWT token sent to a server?
No. The JWT Decoder processes your token entirely in your browser using JavaScript Base64 decoding. Your token — including any session secrets, user IDs, or PII in the payload — never leaves your device. This is critical for security: unlike jwt.io and similar online decoders, you can safely debug production tokens here.
What does the JWT header contain?
The header typically contains two fields: "alg" (the signing algorithm, such as HS256, RS256, ES256, or HS384) and "typ" (the token type, always "JWT"). The algorithm tells you how the signature was created — HS256 means a shared secret, RS256 means an RSA private key. Mismatched algorithms between header and actual signing indicate a potential security issue.
How do I check if a JWT is expired?
The payload contains an "exp" claim (expiration time) as a Unix timestamp in seconds. The decoder converts this to a human-readable date and compares it to the current time. If the token is expired, a red "EXPIRED" badge appears. The payload may also contain "iat" (issued at) and "nbf" (not before) timestamps for full lifecycle validation.
Can this tool verify the JWT signature?
The tool decodes and displays the signature but does not cryptographically verify it — verification requires the secret key (for HMAC) or public key (for RSA/ECDSA), which only the issuing server possesses. However, the tool flags suspicious conditions: weak algorithms (none, HS256 with short keys), expired tokens, and missing required claims.
Is it safe to decode a JWT token in this tool?
Yes. Decoding a JWT only base64-parses the header and payload sections—it does not transmit your token anywhere. Processing runs entirely in JavaScript on your local machine with zero network requests. Unlike jwt.io (which loads third-party analytics), this tool has no tracking, no cookies, and no external dependencies.
Can it verify a JWT signature?
It decodes and displays the header (algorithm, type), payload (claims, expiration, issuer), and signature. For HS256 tokens, you can paste the secret to verify signature integrity locally. It supports RS256, ES256, and HS256 algorithms—the three most common in production OAuth 2.0 and OpenID Connect implementations.
Related tools
Why did the fish blush?
No paywalls, no signups, no data sold. Built by a solo developer who believes useful tools should be accessible to everyone.
☕Support me on Ko-fi— keep tools free100% of proceeds go towards hosting & building more free tools.