Decode, inspect, and validate JSON Web Tokens - 100% in your browser
Enter a JWT token on the left to decode and inspect its contents.
Copy a JWT from your app, API response, or browser DevTools and paste it in the input field.
Explore header (algorithm), payload (user data, expiration), and signature sections.
Verify expiration status, copy decoded JSON, or generate parsing code for your language.
Instantly see if your token is valid or expired with a live countdown timer showing when it expires.
View the signing algorithm (HS256, RS256, ES256, etc.) with security status and recommendations.
View all payload claims including user ID (sub), email, name, roles, permissions, and custom data.
Generate ready-to-use parsing code for JavaScript, Python, Go, and Rust to use in your projects.
The exp claim indicates the token is no longer valid.
Solution: Obtain a new token using your refresh token or re-authenticate. Check your token lifetime configuration if tokens expire too quickly.
The token structure is incorrect or the signature doesn't match.
Solution: Ensure you're copying the complete token including all three parts. Check that your verification key matches the signing key.
Your server expects a different algorithm than what the token specifies.
Solution: Configure your JWT verification to explicitly specify allowed algorithms. Never accept "alg": "none" in production.
This decoder supports standard JWT format (RFC 7519) and works with tokens from any provider:
This decoder runs entirely in your browser. Your JWT tokens are never sent to any server—all parsing happens locally using JavaScript. You can verify this by checking your browser's Network tab, or even use the decoder offline after the page loads. Safe for production tokens, PII, and sensitive data.