How to Decode a JWT
A JSON Web Token looks like an opaque blob of characters, but it isn't encrypted — it's three Base64url-encoded segments separated by dots, and the first two are plain JSON that anyone can read. Paste a token here and it's split apart instantly: the header showing which signing algorithm was used, the payload with all its claims, and the signature segment. What makes debugging easier is the interpretation layered on top. Numeric timestamp claims like exp, iat and nbf are famously unreadable as raw epoch seconds, so they're converted to real dates alongside a relative description like three hours ago. A status banner tells you immediately whether the token is currently active, already expired, or not yet valid — usually the exact question you opened a decoder to answer. Every claim is listed in a table with its meaning, so registered claims like iss, aud and jti are explained rather than left as cryptic abbreviations, and your own custom claims appear alongside them. One important caveat the tool states plainly: decoding is not verification. Reading a token proves nothing about its authenticity — only checking the signature with the correct key does that. Everything runs in your browser, so the token is never transmitted or logged.
Paste the token
Drop in the full JWT; it decodes locally the moment you paste.
Check the status
See at a glance whether it's active, expired or not yet valid.
Read the claims
Review the breakdown, and copy the header or payload JSON.
How a JWT Is Built
Three segments
A token is header.payload.signature. The header and payload are JSON objects encoded with Base64url — readable by anyone. The signature is computed over both using a secret or private key.
Signed, not encrypted
The signature guarantees the token hasn't been altered and came from someone holding the key. It does not hide the contents, which is why sensitive data should never be placed in a JWT payload.
Common Use Cases
Debug authentication
See which user, scopes and roles a token actually carries.
Check expiry
Confirm whether a 401 response is simply an expired token.
Inspect an API response
Read the claims returned by an identity provider.
Verify the algorithm
Check the header to see which signing algorithm was used.
Audit token contents
Confirm no sensitive data was accidentally included in the payload.
Compare environments
Diff the claims issued by staging versus production.
Learn how JWTs work
See the structure of a real token laid out clearly.
Support and triage
Quickly answer why a customer's session stopped working.
Tips & Best Practices
Never put secrets in a payload
The payload is readable by anyone holding the token — treat it as public information.
Always verify server-side
Check the signature and the exp claim on your server; never trust a decoded payload alone.
Keep lifetimes short
Short-lived access tokens with refresh tokens limit the damage if one leaks.
Reject the none algorithm
A token claiming alg: none must never be accepted — it's a classic bypass attack.
Validate the audience and issuer
Confirm aud and iss match your service so tokens from elsewhere are rejected.
Be careful where you paste
Use a local decoder like this one rather than sending live tokens to a server you don't control.
Troubleshooting
It says the token can't be decoded
Check you copied the whole token including both dots, with no line breaks or trailing characters.
There's no signature segment
The token has only two parts, meaning it's unsigned. Unsigned tokens should never be trusted.
The expiry looks wrong
JWT timestamps are epoch seconds, not milliseconds. This tool converts them for you — check your own code does the same.
A claim isn't explained
Only registered claims have standard meanings. Anything else is a custom claim defined by whoever issued the token.
Frequently Asked Questions
How do I decode a JWT for free?
Paste your token above and the header, payload and claims appear instantly — free, no signup.
Is my token sent to a server?
No. Decoding happens entirely in your browser, so the token is never transmitted, stored or logged.
Does this verify the signature?
No. Verification needs the signing secret or public key. This tool decodes and interprets the contents only.
Is a JWT encrypted?
No. It's signed, not encrypted. The header and payload are Base64url-encoded and readable by anyone.
How do I know if a token has expired?
The status banner tells you directly, and the exp claim is shown as a real date plus a relative time.
What does exp mean?
Expiration time — the moment after which the token must be rejected, given in epoch seconds.
What is the difference between exp and nbf?
exp is when a token stops being valid; nbf is when it starts. A token can be issued now but valid later.
What do iss, sub and aud mean?
Issuer, subject and audience — who created the token, who it's about, and who it's intended for.
Can I decode any JWT?
Yes, any standard JWT with Base64url-encoded JSON segments, regardless of the signing algorithm.
Why are timestamps such large numbers?
They're epoch seconds since 1970. This tool converts them to readable dates automatically.
What does alg: none mean?
An unsigned token. It should always be rejected, since anyone could forge one.
Can I put sensitive data in a JWT?
You shouldn't. The payload is readable by anyone holding the token, so treat it as public.
Can I copy the decoded JSON?
Yes. Each of the header and payload sections has its own copy button.
Are custom claims supported?
Yes. Every claim is listed; registered ones are explained and custom ones are shown as-is.
Does it work with expired tokens?
Yes. Expired tokens decode normally and are clearly flagged as expired.
Does it work offline?
Once the page has loaded it runs entirely in your browser, so it keeps working without a connection.
Does it work on phones?
Yes, in any modern browser on Windows, Mac, Android or iPhone with nothing to install.
Is this tool really free?
Completely free, forever — no account, no ads and no premium wall.
100% free · No signup · Decoded in your browser · Never transmitted
Last updated: August 2026 · FlipMyFormat JWT Decoder
Written and maintained by the FlipMyFormat team · Runs entirely in your browser