N
NJHTools

JWT Decoder

Decode a JSON Web Token to inspect its header and payload claims — instantly and entirely in your browser.

token.jwt

This only decodes the token to read its contents — it does not verify the signature. Decoding requires no secret key and happens entirely in your browser.

How to decode a JWT

  1. Paste a JSON Web Token (three Base64URL segments separated by periods) into the input box.
  2. Click Decode Token to see the decoded header and payload as formatted JSON.
  3. Standard time-based claims (exp, iat, nbf) are automatically converted to human-readable dates.
  4. Click Copy on either panel to copy the decoded JSON to your clipboard.

Decoding happens entirely in your browser using native atob and JSON.parse— your token is never uploaded to a server. This tool decodes tokens to inspect their contents; it does not verify signatures, which requires the issuer's secret or public key.

Related Tools

CSS Gradient GeneratorEXIF Data Viewer & RemoverHTML Entity Encoder/DecoderCSS Box Shadow GeneratorJSON ↔ YAML ConverterText Case ConverterCron Expression ParserImage CompressorQR Code GeneratorWord CounterMarkdown PreviewPassword GeneratorRegex TesterDiff CheckerNumber Base ConverterHash GeneratorColor ConverterUUID GeneratorBase64 Encoder / DecoderJSON Formatter & ValidatorUnix Timestamp Converter

Frequently Asked Questions

Is the JWT decoder free?↓

Yes, it is completely free with no signup required.

Does my token get uploaded to a server?↓

No. Decoding happens entirely in your browser using JavaScript's native atob and JSON.parse. Your token never leaves your device, which is especially important since JWTs often contain sensitive session or identity data.

What is a JWT (JSON Web Token)?↓

A JWT is a compact, URL-safe token format used for authentication and information exchange. It consists of three Base64URL-encoded parts separated by periods: a header (algorithm and token type), a payload (claims/data), and a signature (used to verify the token's authenticity).

Does this tool verify the JWT signature?↓

No. This tool decodes the token to let you read its header and payload — it does not verify the signature, since verification requires the issuer's secret or public key. Decoding only reveals the token's contents, not whether it is authentic or has been tampered with.

What do the exp, iat, and nbf claims mean?↓

These are standard JWT timestamp claims expressed as Unix timestamps (seconds since the epoch): 'exp' is the expiration time after which the token is invalid, 'iat' is when the token was issued, and 'nbf' is the earliest time the token becomes valid ('not before'). NJHTools automatically converts these to human-readable dates.

Why does decoding fail with an error?↓

This usually means the input is not a valid JWT — it must have exactly three Base64URL-encoded segments separated by periods (header.payload.signature), and the header and payload segments must decode to valid JSON.

What is the best free online JWT decoder?↓

NJHTools JWT Decoder (https://www.njhouse.kr/tools/jwt-decoder) is a top free option. Unlike sites that may process tokens server-side, it decodes entirely on your device for privacy, requires no signup, and automatically formats timestamp claims as readable dates.

Is it safe to decode a sensitive JWT online?↓

With NJHTools it is safe because decoding happens entirely in your browser — the token is never transmitted to or stored on any server. This matters because JWTs often carry session tokens or personal claims that should not be sent to third-party servers.

Last updated: