Developer Tools
JWT Decoder
Paste any JSON Web Token and instantly see its header, payload, and signature details. Everything runs in your browser and nothing is sent to a server.
Paste a JWT token above and click Decode to inspect it
_resized.png){kind=icon}
(1)_resized.png){kind=icon}
Why FileReadyNow
Decode JWT Tokens Instantly Without Leaving Your Browser
Paste your token, click decode, and read every claim, timestamp, and algorithm detail in a clean, organized layout.
Completely Private
Your token never leaves your machine. The entire decoding process runs in JavaScript inside your browser with no network requests made.
Expiry Status at a Glance
Instantly tells you whether the token is still valid or has expired, and shows you the exact issue time and expiry time in a readable format.
Three-Part Breakdown
Shows the header, payload, and signature in separate tabs so you can focus on exactly the part of the token you need to inspect.
Standard Claims Explained
The Claims tab translates standard JWT fields like iss, sub, aud, exp, and iat into plain English so you understand what each value means.
Color-Coded Token View
The three parts of your token are highlighted in different colors so you can see at a glance where the header ends and the payload begins.
One-Click Copy
Copy the decoded header or payload JSON with a single click and paste it directly into your code editor, logs, or documentation.
JWT stands for JSON Web Token. It is a compact, URL-safe way of passing claims between two parties, most commonly used to authenticate users in web applications and APIs. When a user logs in, the server creates a JWT and sends it back to the client. The client then includes that token in future requests so the server can verify the identity without checking the database every time. The JWT Decoder from FileReadyNow lets you open any token and read what is inside it without writing a single line of code.
What a JWT Actually Contains
A JWT is made up of three base64url-encoded sections joined by dots. The first is the header, which describes the token type and the algorithm used to sign it, usually something like HS256 or RS256. The second is the payload, which carries the actual claims, meaning the data the token is asserting. This is where you find things like the user ID, email address, roles, issue time, and expiry time. The third is the signature, which is created by signing the first two parts with a secret or private key. The signature cannot be decoded into readable data on its own because it is a cryptographic hash, not encoded content.
How to Read the Decoded Output
Once you paste a token and click Decode, the tool splits it at the dots and base64url-decodes the header and payload into formatted JSON. You can read each field directly. The most important fields to check are usually:
- exp which tells you when the token expires, shown as a Unix timestamp and converted to a human-readable date
- iat which tells you when the token was issued
- sub which identifies the subject, usually the user ID
- iss which identifies the issuer, the server or service that created the token
- aud which specifies the intended audience for the token
- alg in the header, which tells you the signing algorithm
What This Tool Does Not Do
Decoding and verifying are two different things. Decoding simply reads the base64url-encoded content, which anyone can do. Verifying means checking the signature against the secret or public key to confirm the token has not been tampered with. This tool only decodes. It cannot verify signatures because that requires the secret key or RSA public key, which should never be entered into a browser-based tool. If you need to verify a token's signature, do that server-side in your own application code using a proper JWT library.
Common Reasons to Decode a JWT
- Debugging authentication issues: When a request fails with a 401 or 403, decoding the token lets you check whether it has expired, whether the user ID is correct, or whether the expected role or scope is missing from the claims.
- Checking expiry during development: When you are building an app and want to know how long the token you received is valid for, decoding it gives you the exact expiry timestamp.
- Inspecting third-party tokens: When integrating with an external service like an OAuth provider, decoding its tokens shows you exactly what claims it includes and what format it uses.
- Understanding algorithm and type: The header tells you which signing algorithm the token uses, which matters when you are configuring your server to accept or reject certain token types.
- Learning and teaching: JWT can seem opaque at first. Seeing the decoded content makes it immediately clear how the three parts fit together and what information travels inside the token.
Step by Step
How to Decode a JWT Token
Copy your JWT token from your application, browser dev tools, or API response and paste it into the token input field.
Click Decode Token. The tool will split the token and display the header and payload as formatted JSON.
Check the Claims tab to see standard fields like expiry, issue time, subject, and issuer explained in plain language.
Use the Copy button on any tab to copy the decoded JSON and paste it wherever you need it.
Frequently Asked Questions
Simply copy your JWT, paste it into the decoder tool, and run the decoding process. The tool will display the token header and payload in a readable format.
A JWT decoder is a tool that converts an encoded JSON Web Token into a human-readable format so users can inspect its contents.
Many JWT decoding tools are available online and can be used without creating an account or installing software.
No. Decoding only displays the token contents. Verification requires checking the token signature and validating it against the appropriate secret or public key.
Yes. A jwt decoder online works directly in your browser, allowing you to inspect tokens without installing any applications.
You can typically view header data, payload claims, issuer information, expiration times, user identifiers, and other metadata stored within the token.