Free JWT decoder
Decode and inspect JSON Web Token (JWT) headers and payloads — instantly in your browser. See the algorithm, token type, issued-at and expiry timestamps, and all claims. Your tokens are never sent to a server. Essential for developers debugging authentication flows and API integrations.
How to decode a JWT
- Paste your JWT token into the input.
- The header and payload are decoded and displayed instantly.
- Issued-at and expiry timestamps are converted to human-readable dates.
- Check whether the token is expired.
What is a JWT?
A JSON Web Token is a compact, URL-safe way to transmit claims between parties. It's used everywhere in modern authentication: OAuth 2.0, OpenID Connect, API authorisation headers, and single sign-on. A JWT has three Base64-encoded sections separated by dots: header, payload and signature.
Is it safe to decode tokens here?
Yes. The decoding happens entirely in your browser using JavaScript — your token is never sent over the network. The signature section is displayed but not verified here (verification requires the secret or public key that only your server should have).
Frequently asked questions
Does the JWT decoder verify the token signature? No — the ToolCrix JWT decoder only decodes the readable header and payload; signature verification requires the secret or public key on your server.
Does the JWT decoder send my token anywhere? No — ToolCrix decodes JWTs entirely in your browser with JavaScript; the token never leaves your device, so even production tokens are safe to inspect.
Why is my token marked expired? The ToolCrix decoder converts the exp claim to a readable date — if it's earlier than now, the token is expired and your API will reject it.
What claims will I see in the payload? The ToolCrix JWT decoder shows every claim — standard ones like iss, sub, iat and exp (with human-readable timestamps) plus any custom claims your auth server adds.