Free Online JWT Decoder
Paste a JSON Web Token to instantly decode and display the header, payload claims, and algorithm. No secret key required. All decoding runs in your browser — no data is sent to BuBird servers.
✓ Free developer tool✓ No account required✓ Browser-based utility✓ Fast results✓ Mobile friendly
JWT Token
This tool runs in your browser and does not upload your data to BuBird servers.
This tool decodes the JWT header and payload for inspection only. It does not verify the token signature. Do not paste tokens from live production systems or tokens containing sensitive user data into online tools.
How To Use
How to Use JWT Decoder
1
Paste Your JWT
Paste the full JWT string (three dot-separated segments) into the input field.
2
Decode the Token
The header and payload are decoded and displayed as formatted JSON. The algorithm, token type, and all claims are shown.
3
Inspect Claims
Review fields such as sub (subject), exp (expiry), iat (issued-at), roles, and any custom claims included in the payload.
4
Check Expiry
If an exp claim is present, the tool displays the expiry timestamp so you can confirm whether the token is still valid.
Example
Example Use
Inspecting a Token During API Development
During development, you receive a JWT from your auth service but your API call is failing. Paste the token into the decoder to quickly check the exp field (is it expired?), the sub or user_id field (is it the right user?), and the roles or scope claim (does it include the required permission?). This saves time compared to writing decode logic in a REPL.
Use Cases
Who Uses JWT Decoder
Backend Developers
Inspect JWT claims during development to verify auth middleware is issuing the correct payload fields.
Frontend Developers
Check the payload of tokens stored in localStorage or cookies to debug authentication flows.
QA Engineers
Verify that tokens returned by the auth service contain the correct roles, scopes, and expiry during testing.
API Integrators
Decode tokens from third-party identity providers to understand the claims structure before implementing parsing logic.
Students & Learners
Explore how JWT structure works by decoding example tokens and reading the header and payload fields.
Security Reviewers
Inspect tokens in controlled test environments to check for insecure algorithm choices (e.g. alg: none) or overly permissive claims.
Related Tools
Related Developer Tools
FAQ
Frequently Asked Questions
Does the JWT Decoder verify the token signature?
No. This tool decodes the header and payload by Base64-decoding the first two JWT segments. It does not verify the signature and cannot confirm whether a token is authentic or has been tampered with.
Is it safe to paste my JWT into this tool?
The tool runs in your browser and does not send your token to BuBird servers. However, avoid pasting production tokens, user tokens, or secrets from live systems into any online tool as a security best practice.
What does a JWT contain?
A JWT has three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims such as user ID, roles, and expiry), and a signature (used to verify authenticity server-side).
Can I see when a JWT expires?
Yes. The payload typically contains an exp claim (Unix timestamp). The decoder displays this value so you can check when the token expires.
What is the difference between JWT decoding and JWT verification?
Decoding reads the header and payload without validating authenticity. Verification checks the signature against a secret or public key to confirm the token is genuine and untampered. Only your backend can securely verify a JWT.