How to Decode a JWT Token Online for Free
Need to see what's actually inside a JWT — without writing code? Here's how to decode a JSON Web Token online, free, in seconds.
Try it now: JWT Decoder →
A JWT looks like a long, meaningless string of characters, but it actually encodes a header and a payload — often containing useful debugging information like a user ID, expiry time, or role. Decoding it lets you see exactly what's inside without writing a single line of code.
When you need to decode a JWT
- Debugging why an API call is failing by checking the token's claims
- Confirming a token hasn't expired by checking its expiry (
exp) field - Verifying a token contains the fields your application expects
- Inspecting a token from a bug report or support ticket
How to decode a JWT, step by step
- Open the JWT Decoder.
- Paste the JWT token.
- The tool splits it into its header and payload and displays both as readable JSON.
- Review the claims — issuer, subject, expiry, and any custom fields.
Tips for working with JWTs
- Decoding isn't the same as verifying. Anyone can decode a JWT and read its contents — decoding doesn't confirm the token is genuine or hasn't been tampered with, which requires checking its signature against the issuer's secret or key.
- Check the
expfield for expiry issues. A token that's failing authentication is very often simply expired — use the Timestamp Converter to turn that Unix timestamp into a readable date. - Never paste a production token from a real user session into a third-party tool you don't trust — treat tokens as sensitive credentials.
Common questions
Can decoding a JWT reveal a secret or password? No — a JWT's payload only contains whatever claims the issuer put in it; it doesn't expose the signing secret.
Does this verify whether the token is valid? No — this decodes and displays the token's contents. Verifying a signature requires the issuer's secret or public key, which happens server-side.
Why does the payload contain a timestamp instead of a date? JWTs store dates as Unix timestamps for compactness — convert them to a readable date with the Timestamp Converter.
Have a token you need to inspect? Decode a JWT for free →