Free JWT Decoder
Decode a token's header and payload, read every claim and check expiry — without handing a live session token to a stranger's server.
Something not working?
Tell us what went wrong — it helps us fix the tool. Only what you type below is sent; your token never leaves your device.
Need more power? Meet JWT Decoder Pro
One-time payment. Yours forever. No subscription.
| Feature | Free | Pro |
|---|---|---|
| Decode header + payload | Yes | Yes |
| Expiry + claim explanations | Yes | Yes |
| HS256 signature check | Yes | Yes |
| Batch decode (paste many tokens) | — | Yes |
| Diff two tokens claim by claim | — | Yes |
| RS256 / ES256 public-key check | — | Yes |
| Ads | Shown on page | Ad-free |
| Updates | — | Lifetime free updates |
Frequently asked questions
Is my token uploaded anywhere?
No. Decoding runs entirely in your browser with JavaScript. Nothing is sent to any server — open the network panel while you decode and you will see zero requests. That is the whole point: a live JWT is a working session credential.
Does decoding verify the token?
No. Decoding only reads the base64url-encoded header and payload — anyone holding the token can do that, with or without the secret. Verification is a separate step: the optional HS256 check above recomputes the signature with a secret you provide, locally.
Why does it say my token is expired when it still works?
Expiry is judged against your device clock. If your clock is wrong, or the server allows a clock-skew leeway, the two can disagree. Check that your system time is correct first.
Can I paste a token with a "Bearer " prefix?
Yes. A leading Bearer prefix is stripped automatically before decoding.