Decode JWT Online — Free
Decode JWT (JSON Web Tokens) instantly — free, in your browser, with no upload or signup. Paste a JWT and see the decoded header (algorithm, type), payload (claims like iss, sub, exp, iat), and the signature segment. The decoder shows expiration in human-readable form, validates segment encoding, and warns on common issues like missing exp or alg=none. Runs 100% client-side — your tokens never leave your device. Safe for production access tokens, refresh tokens, and ID tokens. Use it for API debugging, OAuth flows, Auth0 / Firebase / Supabase integration, and security audits.
How to decode jwt online
- Paste your input (JSON, JWT, CSV, or other text) into the tool above.
- Choose the format/option you need — everything is computed in your browser.
- Copy the result with one click, or download it as a file.
Common use cases
- Debugging API responses and inspecting JWT payloads
- Pretty-printing minified JSON copied from network tabs or logs
- Converting between data formats (CSV ↔ JSON, JSON ↔ YAML)
- Validating syntax before pasting into config files
- Sharing readable snippets with teammates in pull requests
Frequently asked questions
Is it safe to paste a JWT here?
Yes — decoding happens entirely in your browser. The token is not uploaded or logged anywhere.
Can I verify the JWT signature?
Decoding does not verify — verification needs the secret/public key. Use this tool for inspection only; verify server-side in production.
What does the "exp" claim mean?
Expiration timestamp (Unix seconds). The decoder shows it in human-readable date/time.
Why is my JWT marked invalid?
JWTs have three base64url segments separated by dots. Missing segments or invalid base64 encoding triggers the warning.