Loading tool…
Loading tool…
Decode JSON Web Tokens without sending them to a server.
Decode JSON Web Tokens without sending them to a server.
Nextooly’s JWT Decoder lets you safely inspect JSON Web Tokens directly in your browser. Paste a JWT and instantly view the decoded header and payload as formatted JSON, along with human-readable timestamps for common claims like exp, iat, and nbf.
The tool uses base64url decoding locally and never uploads or logs your token, making it suitable even for sensitive development and debugging scenarios. It does not verify signatures, but it’s perfect for checking token structure, claims, expiry, and debugging authentication and API issues.
Example
Input: The source text, file, or settings you want to work with.
Output: A clean jwt decoder result ready for the next step.
If JWT Decoder is close but not quite the right fit, these related Nextooly tools cover adjacent developer & code workflows without sending you to another service.
Best if you need to encode and decode Base64 safely in your browser.
Best if you need to compute SHA-256, SHA-1, and MD5 hashes for text and files.
Best if you need to aES-256-GCM secure text encryption and decryption with password-based key derivation.
Does this JWT decoder upload my token to any server?
No. The token is decoded locally in your browser using base64url decoding. Nothing is sent, stored, or transmitted anywhere.
Why do I get an error saying the token is invalid?
JWTs must contain at least two dots (header.payload.signature). Missing segments, invalid base64url encoding, or malformed JSON will trigger an error.
What does this tool actually decode?
It decodes the header and payload sections of the JWT. It does NOT verify the signature or check token authenticity.
Can this tool tell if my JWT is expired or not yet valid?
Yes. If the payload contains standard claims like exp, iat, or nbf, the tool displays human-readable timestamps and whether the token is expired or not yet valid.
Why do my dates look incorrect?
JWT timestamps are in Unix seconds. If a timestamp is malformed or not a valid number, formatting may fail and show an empty or incorrect result.
Can I copy the decoded header or payload?
Yes. Each section has its own Copy button, which copies the formatted JSON to your clipboard.
What does the JSON indentation setting do?
It controls whether decoded JSON is shown using 2-space or 4-space indentation. This only affects display formatting.
Does this tool verify the signature?
No. It only decodes base64url and parses JSON. Signature verification requires a secret or public key and is intentionally not performed for safety.
Why does clearing the token remove the decoded fields?
When you clear the input, the tool resets all decoded values, claims information, and error messages to prevent outdated data from appearing.
2026-03-10
Related category
Related comparison/alternatives article