Skip to content
Free Tab Toolsnothing uploaded

Runs in your browser · Last updated 4 September 2026

Free JWT Decoder — Header, Payload, Expiry

Free JWT decoder. Decode a JSON Web Token in your browser — header, payload, expiry, and claims. Nothing is uploaded.

Paste a JWT to decode it.

How to use this tool

  1. Paste a JWT. It should be three Base64url segments joined by dots.
  2. Read the header and payload as formatted JSON.
  3. Check expiry and the plain-English claims list.
  4. Convert iat or exp in the Unix timestamp converter if you need a calendar date.

What a JWT decoder actually does

A JSON Web Token is three segments: header, payload, and signature. The first two are JSON objects passed through URL-safe Base64. Anyone who has the token can read those objects. A decoder does not prove the token is authentic. That is what signature verification is for, and it requires a key we will not ask you to paste into a website.

This page exists because developers still paste tokens into whatever ranks. Most ranking clones POST the string to an API. That is a terrible default for an access token. Here the decode path is atob plus JSON.parse, in this tab.

Worked example

Click “Load sample”. The header is {"alg":"HS256","typ":"JWT"}. The payload includes sub, name, admin, iat 1516239022, and exp 1516242622. Both timestamps convert to 18 January 2018. The expired badge should be on. The signature is shown as present and is not checked.

Frequently asked questions

Is it safe to decode a JWT online?
Decoding only Base64url-decodes the header and payload. This page does that in your browser. The token is not posted to a server. Still treat live access tokens carefully and prefer expired samples.
Do I need the secret to decode a JWT?
No. Header and payload are encoded, not encrypted. You only need a secret or public key to verify the signature, which this tool does not do.
Why is the sample token expired?
The classic jwt.io example uses iat 1516239022. That is useful: you can see an expired badge and jump to the Unix timestamp converter for the same number.
What algorithms can I inspect?
Any JWS you can paste. The alg claim is displayed. Verification of HS256, RS256, or ES256 is intentionally omitted so we never ask for a secret.
How do exp and iat work?
They are Unix timestamps, usually in seconds. Convert them with the timestamp tool to UTC or ISO 8601.