JWT Decoder
Decode a JSON Web Token's header and payload, with human-readable expiry, issued-at and claims. Free and private: runs in your browser.
Paste a JWT (or a whole Authorization header) to see its header, payload and claims, including when it expires, decoded as you type.
Hashing runs locally in your browser. Your input never leaves this page.
Use cases
- Debug a 401 by checking a token's expiry, audience and issuer.
- Inspect the claims your identity provider actually sends.
- Create test tokens for local API development.
Frequently asked questions
Can a JWT be decrypted without the secret?
A normal signed JWT (JWS) is only Base64URL-encoded, so anyone can read it; the secret is only needed to verify or create the signature. Encrypted JWE tokens cannot be read without the key.
Is the JWT Decoder free?
Yes. It is free with no sign-up, and it runs entirely in your browser, so your input is never uploaded or stored.
Is hashing the same as encryption?
No. A hash is one-way: you cannot get the input back. Encryption is reversible with a key. Use slow password hashes (bcrypt, Argon2, PBKDF2) for passwords and fast hashes (SHA-256) for integrity checks.
Related tools
Checking one snippet is a start. Scan your whole repository for free with CodeInspector.