JWT Decoder
Paste a JSON Web Token and read its header, payload, signature and expiry in your browser. The token never leaves the page, and the signature is not verified.
Decoding only reads the token contents. It does not verify the signature or prove that the claims are trustworthy.
What a JWT decoder does
A JSON Web Token is three base64url segments joined by dots: a header that names the signing algorithm, a payload that carries the claims, and a signature. APIs hand these tokens out at login and expect them back on every request, so when something fails you need to read the payload before you can debug anything.
This decoder splits the token, parses the header and payload and prints the claims in a table with human-readable timestamps. It runs entirely in your browser, so internal tokens and customer data never reach a server, and because verifying a signature would require you to paste a secret into a web page, that step is left to your own code.
How to decode a JWT
- Paste the token into the input box — a raw string or a whole Authorization: Bearer line both work, and the prefix is stripped automatically.
- Press Decode, or press Generate sample if you just want to see what a decoded token looks like.
- Read the Header and Payload blocks, then use the Claims table to see the issuer, subject and audience in plain language.
- Check the exp row: the table converts it to local time and tells you whether the token is expired, still valid or not yet active.
JWT decoder examples
Access token from a login response
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwiaXNzIjoiaHR0cHM6Ly91cnNha2l0LmNvbSIsImV4cCI6MTc5MDAwMDAwMH0.abc123
Header {"alg":"HS256","typ":"JWT"}, payload with sub, iss and exp, plus a claims table row that shows the expiry in local time.Expired token
The same shape, but with exp set to a timestamp in the past
The exp row turns into Expired at <local time>, which is the fastest way to tell a clock problem from a permissions problem.
Messy copy from DevTools
Authorization: Bearer eyJhbGciOiJIUzI1N… (with quotes and a line break)
The decoder removes Authorization, Bearer, quotes and whitespace, then decodes the token normally.
UrsaKit vs other JWT decoders
| Dimension | UrsaKit | jwt.io | token.dev | devglan.com |
|---|---|---|---|---|
| Price | Free, no sign-up | Free with paid extras | Free | Free with ads |
| Where the token is decoded | Your browser | Your browser | Your browser | Your browser |
| Uploads the token | No | No | No | No |
| Claim explanations | Yes, with expiry status | Partial | No | No |
| Verifies the signature | No, by design | Yes, needs your key | Yes, optional | Yes, needs your key |
| Encoder included | No | Yes | Yes | Yes |
Frequently asked questions
Is this JWT decoder free?
Yes. Decoding, the claims table, the sample token and copying are free, with no account and no usage limit.
Is my token uploaded anywhere?
No. The token is decoded with JavaScript in your browser and is never sent to a server, stored or logged.
Does it verify the JWT signature?
No. This page only decodes. Verifying a signature needs the issuer's secret or public key, and asking you to paste a secret into a web page is a needless risk.
Can I trust the claims in a decoded JWT?
Treat them as data. Anyone can craft a token with any payload, so the values are trustworthy only after your own backend verifies the signature.
How do I read the exp claim?
exp is a Unix timestamp in seconds. The claims table converts it to your local time and marks the token expired, valid or not yet active.
Can it decode a token with alg: none?
Yes. The third segment is then empty; the decoder says No signature segment (alg: none) and still shows the header and payload.