How do I decode a JWT without a library?

Paste the token into JWT Token. It must have three dot-separated segments, and the Header, Payload and Signature sections appear. Load example fills in a sample token.

Does decoding a JWT mean it is valid?

No. Decoding only reads the claims, and anyone can craft a token with any claims. The tool warns that claims stay untrusted until the signature, issuer, audience and algorithm are verified.

How can I check whether my token has expired?

The payload's exp, nbf and iat claims are shown with a status such as Expired or Not expired, and it refreshes while the tab is open. A Clock skew (seconds) field adjusts the check.

Can I verify the signature here?

Yes. Paste an HMAC secret, PEM public key or JWK / JWKS JSON under Verify signature, then click Verify. HS, RS and ES algorithms with 256, 384 or 512 bits are supported.

Why does it say the token is invalid?

A JWT needs exactly three dot-separated segments, and the header and payload must be Base64URL-encoded JSON. If either fails, the tool reports which part is wrong. Extra spaces or truncated copies are common causes.

Yes. Every tool is free to use, with no account and no credit card. The work runs on your device rather than on our servers, which is what keeps it free to run.

Does it work on mobile?

Yes. It runs in current mobile browsers on iOS and Android, with nothing to install.

🔑

Free JWT Decoder

Decode and inspect any JSON Web Token. View header, payload, expiration, and standard claims. Everything runs locally in your browser — tokens never leave your device.

Runs in your browserNo sign-up, no pop-upsNo login requiredFree forever

Works offline once loaded

JWT Token

🔒 The token is decoded entirely in your browser. Nothing is sent to any server.

Common uses

Debug Authentication Issues with JWT DecoderInspect JWTs from your app to debug login failures, permission issues, and token expiration problems.
Inspect API Tokens While Testing EndpointsDecode JWTs returned by your API to verify the right claims, scopes, and permissions are being issued.
Security Audit JWT TokensReview JWTs as part of a security audit — check for weak signing algorithms, excessive token lifetimes, or sensitive data in the payload.
Inspect OAuth and OpenID Connect TokensDecode access tokens, ID tokens, and refresh tokens from Google, Auth0, Okta, Microsoft, and other OAuth providers.
Learn How JWT Tokens WorkDecode example JWTs to understand the structure: header, payload, and signature. See real-world claim examples.

How It Works

The decoder is a hand-written, zero-dependency parser that runs entirely in your browser: it splits the token on dots, converts each Base64URL segment to plain Base64 using string replacement and pads it to a multiple of four, then calls the browser's native atob() and JSON.parse to recover the header and payload objects. Optional signature verification uses the Web Crypto API (crypto.subtle.verify) — no library, no server.

1
Base64URL decoding
The tool splits the JWT on its two period delimiters, giving three segments. Each segment is Base64URL — which uses - and _ instead of + and / and omits padding. The code swaps those characters back and pads with = signs, then calls the browser's built-in atob() to decode the bytes.
2
JSON parsing and claim extraction
The decoded bytes are passed through JSON.parse to produce the header and payload objects. Registered claims exp, iat, and nbf are extracted as Unix timestamps and converted to Date objects; expiry status is rechecked every 20 seconds via setInterval so a token that expires while the tab is open flips from valid to expired automatically. Relative timestamps ('in 3 days', '2 hours ago') are formatted with Intl.RelativeTimeFormat using your browser locale.
3
Signature display and optional verification
The raw Base64URL signature string is shown alongside the header and payload. If you supply a key, the tool calls crypto.subtle.importKey and crypto.subtle.verify to check the signature locally. It accepts HMAC shared secrets (HS256/384/512), PEM-encoded RSA public keys (RS256/384/512), and ECDSA public keys or JWK/JWKS objects (ES256/384/512) — determined by the alg field in the header.
4
No network requests
Every step — decoding, timestamp math, and cryptographic verification — runs inside the browser JavaScript engine. The token and any key material you enter never leave your device.

JWTs often carry session credentials, user identity, and authorization scopes; this tool decodes and optionally verifies them entirely in your browser using atob() and the Web Crypto API, so neither the token nor any key you supply is transmitted anywhere.