JWT Decoder – Free Online JSON Web Token Decoder

Decode and inspect JWT tokens instantly. View header, payload, and signature. Shows expiration time and claims. No verification (demo only).

Pruébalo gratis →

Características

🔓

Instant Decode

Paste any JWT and see its contents decoded immediately. No clicking needed.

📋

Three Parts Displayed

Header and Payload shown in formatted JSON with syntax highlighting. Signature shown separately.

⏰

Expiration Check

Automatically parses iat, exp, and nbf claims. Shows if the token is expired or not yet valid.

🔒

Privacy First

All decoding is local in your browser. Your JWT is never sent to any server.

📋

Copy Parts

Copy the full decoded payload, header, or any specific claim.

⚠️

No Signature Verification

This tool decodes only — it does NOT verify signatures. Always verify tokens server-side for security.

Cómo usarlo

1

Paste JWT

Paste your JWT token into the input field. The token has three parts separated by dots (xxx.yyy.zzz).

2

View Decoded

The header appears on top, payload in the middle, and signature at the bottom.

3

Check Expiration

If the token has an exp claim, you'll see the expiration time and whether it's currently valid.

4

Copy

Copy any part of the decoded token to your clipboard.

Preguntas frecuentes

What does JWT stand for?
JWT stands for JSON Web Token. It's a compact, URL-safe way to represent claims between two parties. A JWT has three parts: Header, Payload, and Signature.
Is this tool secure?
This tool is for educational and debugging purposes only. It decodes JWTs locally and does NOT verify signatures. Never trust a JWT's claims without server-side verification.
What are standard JWT claims?
Common claims: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), jti (JWT ID). Custom claims can also be added.
Why can't I see the signature?
The signature is just a base64-encoded binary blob. It has no human-readable content. What matters is whether the signature is valid, which requires the secret key.
Is my JWT sent to a server?
No. All decoding happens locally in your browser using JavaScript's atob function. Your JWT never leaves your device.

← Volver al inicio de pudone!