Free JWT Decoder — Inspect JSON Payload, Header & Expiry
Decode a JSON Web Token and read the JSON payload, header, and claims. See exp/iat as dates. Secure and private in your browser.
Quick answer
To decode a JWT, paste the token into the KaviForge JWT Decoder. It splits the token into header, payload, and signature, pretty-prints the JSON, converts exp, iat, and nbf timestamps to readable dates, and tells you whether the token is expired. Decoding does not verify the signature.
Paste a JSON Web Token to decode the header and JSON payload, convert exp and iat to readable dates, and see whether the token has expired. Decoding never leaves your browser.
The JSON payload is only Base64URL-encoded, not encrypted — anyone with the token can read claims. Use this decoder to debug 401s, inspect roles, and confirm expiry without uploading the token.
Related reading: What is a JSON Payload? A Simple Guide for API Beginners, Privacy-First Formatting: Why Our Online JSON Tool is 100% Safe, and How to Minify JSON (and Why It Makes Your Site Faster).
How to Decode a JWT and Inspect the JSON Payload
- 1Copy the token from your Authorization header, cookie, or local storage.
- 2Paste it into the JWT token box — a leading "Bearer " is removed automatically.
- 3Check the status banner to see if the token is valid, expired, or not yet valid.
- 4Review the decoded header and payload JSON.
- 5Read registered claims (iss, sub, aud, exp, iat, nbf) with human-readable dates.
Features
Header & Payload JSON
Pretty-printed, copyable JSON for both token sections.
Expiry Status
Instantly see if a token is expired, not yet valid, or has no exp claim.
Readable Timestamps
exp, iat, and nbf converted to local time and ISO 8601.
Claims Breakdown
Issuer, subject, audience, JWT ID, algorithm, type, and key ID at a glance.
Helpful Errors
Detects malformed tokens, wrong part counts, and encrypted JWE tokens.
Private by Design
Tokens are decoded locally — they are never sent to a server.
When to Use the JWT Decoder
Debug 401 Unauthorized errors
Check whether an access token has expired or has the wrong audience or issuer.
Inspect OAuth and OpenID Connect tokens
Read ID tokens from Auth0, Firebase, Cognito, Okta, or Azure AD to see user claims.
Verify roles and scopes
Confirm that a token carries the permissions your API expects.
Learn how JWTs work
Load the sample token to explore the structure of a real JWT.
About the JWT Decoder
The decoder splits the token on dots, Base64URL-decodes the header and payload, and parses them as JSON. The signature is shown but not verified, because verification requires the secret or public key.
Because JWTs often grant access to real accounts, never paste production tokens into tools that send data to a server. This tool runs entirely in your browser.
JWT Decoder FAQs: JSON Payload, Expiry & Privacy
How do I inspect the JSON payload of a JWT?
Paste the token into the KaviForge JWT Decoder. The header and JSON payload are Base64URL-decoded and pretty-printed instantly, including exp and iat as dates.
How do I decode a JWT token?
Paste the token into the KaviForge JWT Decoder. The header, payload, and claims are displayed instantly.
Can I decode a JWT without the secret key?
Yes. The header and payload are only Base64URL-encoded, not encrypted, so they can be read without a key. The key is only needed to verify the signature.
How do I check if a JWT is expired?
The decoder compares the exp claim with the current time and shows a status banner, plus the exact expiry date.
Does this tool verify JWT signatures?
No. It only decodes. Always verify signatures on your server with the correct secret or public key before trusting claims.
What do exp, iat, and nbf mean?
exp is the expiry time, iat is when the token was issued, and nbf is the time before which it must not be accepted. All are Unix timestamps in seconds.
Is it safe to paste my token here?
Decoding happens only in your browser and nothing is transmitted. Still, avoid sharing production tokens with others.
Popular JWT Decoder searches
- Decode a JWT Token OnlineDecode a JWT token online to read its header and payload claims. Paste the token and see readable JSON instantly. Runs in your browser, nothing is uploaded.
- JWT Expiration CheckerCheck when a JWT expires. Paste the token to read the exp claim as a human-readable UTC date and see if your access token is still valid.
- Decode a JWT Without the SecretYou can decode a JWT without the secret because the header and payload are only Base64URL encoded. Paste a token to read it. Verification needs the key.
- JWT Payload Viewer — Read JSON Payload ClaimsInspect a JWT JSON payload, including iss, aud, sub, and exp claims. Free, secure, and private — decode a JWT in your browser now.
- Decode an Auth0 JWTDecode Auth0 ID tokens and access tokens to inspect claims like iss, aud, scope and custom namespaced claims. Free, local and private.
- Decode a Firebase ID TokenDecode a Firebase Authentication ID token to inspect uid, email, auth_time and sign-in provider claims. Free browser-based Firebase JWT decoder.
- Decode an AWS Cognito JWTDecode AWS Cognito ID and access tokens. Inspect token_use, cognito:groups, client_id and username claims. Free local JWT decoder.
- JWT Header and Algorithm CheckerCheck a JWT header for the alg, typ and kid fields. Find out whether a token is signed with HS256 or RS256 and which key ID to verify with.
- JWT Claims Explained With a Live DecoderLearn what every registered JWT claim means: iss, sub, aud, exp, nbf, iat and jti. Paste a token to see each claim decoded.
- JWT nbf (Not Before) Claim CheckerCheck the JWT nbf claim. See the "not before" time as a readable UTC date and find out why a fresh token is rejected as not yet valid.
Related Developer Tools
Base64 Decoder
Decode Base64 and Base64URL strings to text, or back to images and files. UTF-8 safe.
Unix Timestamp Converter
Convert Unix epoch timestamps to dates and dates to timestamps. Seconds, milliseconds, UTC, and local time.
JSON Formatter & Validator
Pretty print, beautify, minify, and validate JSON online free. Tree view, file upload, private browser-only.
Related Guides & Tutorials
What is a JSON Payload? A Simple Guide for API Beginners
What is a payload in an API? See a sample JSON payload, payload JSON, and API payload examples — then format one with our free tool.
Privacy-First Formatting: Why Our Online JSON Tool is 100% Safe
Format or minify JSON without uploading a JSON payload. Our formatter is 100% client-side and private. Pretty print JSON securely now.
How to Minify JSON (and Why It Makes Your Site Faster)
Learn how to minify JSON to shrink payloads and speed up APIs. Use the free minifier — minify JSON in your browser in one click.