JWT Decoder
Read the header, claims and expiry of a JSON Web Token locally.
Decoding only reads the token — it does not verify the signature, which needs the issuer's secret or public key.
Runs entirely in your browser — nothing is uploaded.
About the JWT Decoder
The Freemium.Tools JWT decoder reads a JSON Web Token in your browser and shows its header, payload claims and expiry without sending the token anywhere.
A JWT has three parts separated by dots: a header describing the signing algorithm, a payload of claims such as the user ID and expiry, and a signature. The first two parts are only Base64URL encoded, which means anyone holding the token can read them.
That is why decoding is useful for debugging but never a security check — the token still has to be verified with the issuer's secret or public key on a server.
How to use it
- 1Paste the token. Drop the full three-part token into the box.
- 2Read the claims. Header, payload and expiry status are shown immediately.
- 3Copy what you need. Copy the decoded JSON into your notes or bug report.
Frequently asked questions
Does this verify the signature?
No. Verification needs the issuer's secret or public key, which should never be pasted into a website. This tool only decodes the readable parts.
Is it safe to paste a real token here?
The decoding happens in your browser and the token is never transmitted, but treat any live token as a credential and rotate it if you are unsure.
What does the exp claim mean?
It is the expiry time as a Unix timestamp. The tool converts it to your local time and flags whether the token has already expired.
Why is my payload unreadable?
If the middle section is not valid Base64URL JSON, the token is truncated or it is an encrypted JWE rather than a signed JWT.
Is it free?
Yes, with no sign-up.