Ad BlockedPlease disable your ad block to support our free services.

JWT Decoder

Open a token and inspect its claims and metadata to check expiry and scope. This helps when debugging authentication flows or validating tokens during development.

Utilityv1.0.0

JWT Decoder

Paste any JSON Web Token to decode and inspect its header, payload, and signature. Expiry detection, claim explanations, and raw Base64URL sections: all local.

Paste JWT Token

Paste a JWT above to decode it

Or to see how it works

Full Token Inspection

Decode and display the header, payload, and signature sections of any JWT with syntax-highlighted JSON output.

Expiry & Claim Analysis

Instantly see whether a token is valid, expired, or has no expiry, with a human-readable remaining time.

100% Private & Local

Tokens are decoded entirely in your browser using JavaScript. Nothing is ever sent to a server or logged.

Guide

How to Decode a JWT

1

Paste Your Token

Copy a JWT from your browser's dev tools, an API response, or a log file and paste it into the input area.

2

Inspect Header & Payload

The tool splits the token into its three parts and renders the header and payload as formatted, syntax-highlighted JSON.

3

Check Expiry & Claims

Well-known registered claims (exp, iat, sub, iss, etc.) are explained inline, with timestamps converted to human-readable dates.

4

Copy Any Section

Copy the full token, just the header JSON, the payload JSON, or the raw signature with one click.

Ad BlockedPlease disable your ad block to support our free services.
Use Cases

Who Uses a JWT Decoder?

Backend Developers

Inspect tokens from authentication flows during local development to verify claims, audiences, and expiry windows.

Frontend Developers

Check the contents of access tokens stored in localStorage or cookies to debug authorization issues.

Security Researchers

Examine JWT structure, algorithm choice, and claim composition when auditing authentication implementations.

QA Engineers

Verify that issued tokens contain the correct claims, roles, and scopes before running automated test suites.

DevOps & SREs

Decode tokens from service-to-service calls in logs and traces to diagnose auth failures in production.

API Developers

Inspect OAuth 2.0 access tokens and OIDC ID tokens when integrating with third-party identity providers.

Ad BlockedPlease disable your ad block to support our free services.
Comparison

Endless Forge vs Other JWT Tools

Private, claim-aware, and fully local - no token ever leaves your browser.

Feature
Other Toolsaverage
Endless Forge✦ This website
Expiry status & countdown
Sometimes
Yes
Human-readable claim explanations
Sometimes
Yes
Syntax-highlighted JSON
Sometimes
Yes
Copy header/payload separately
No
Yes
Zero server processing
No
Yes
Free to use
Limited
Yes
Ad BlockedPlease disable your ad block to support our free services.

Understand every token at a glance

The Endless Forge JWT Decoder goes beyond raw Base64 decoding. It identifies and explains all IANA-registered JWT claims, converts Unix timestamps to readable dates, highlights the algorithm family, and shows the precise expiry status with remaining time. Because decoding happens entirely in JavaScript, sensitive tokens from production environments never leave your machine.
Ad BlockedPlease disable your ad block to support our free services.
Explore

More Utility & Developer Tools

Ad BlockedPlease disable your ad block to support our free services.
FAQ

Frequently Asked Questions

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It consists of three Base64URL-encoded sections: header, payload, and signature: separated by dots.
No. The header and payload sections of a JWT are Base64URL-encoded, not encrypted: anyone who has the token can decode and read them without knowing the secret. The secret is only needed to verify the signature. The decoder shows you all claims in the token; to verify the signature, you would need the appropriate key and a verification library. For encoding arbitrary data to Base64 outside of JWT context, the Base64 Encoder handles both standard and URL-safe variants.
Because all decoding happens locally with no network requests, the token never leaves your device. As best practice, revoke or let expire any sensitive token before sharing it anywhere.
The header specifies the token type and signing algorithm. The payload contains the claims. The signature is a cryptographic hash used to verify the token has not been tampered with.
The decoder can display the contents of JWTs signed with any algorithm: HS256, RS256, ES256, PS256, and their SHA-384 and SHA-512 variants. The signing algorithm is stated in the header's alg claim. Note that displaying the payload does not require verifying the signature: the decoder shows all claims regardless of the signing algorithm. For generating secure random identifiers to use as JWT jti (JWT ID) claims, the UUID Generator produces standards-compliant UUIDs.
The 'none' algorithm means the token has no signature. Some vulnerable JWT libraries accept unsigned tokens as valid, allowing attackers to forge arbitrary claims.

6 questions answered

Ad BlockedPlease disable your ad block to support our free services.
Startup Fame Verification