Header and Payload
See the decoded header and payload as formatted JSON, ready to copy.
DEVELOPER TOOL / JWT
Free Online JWT Decoder
Decode a JSON Web Token to read its header, payload and claims. See when it was issued, when it expires and which algorithm it uses — instantly and privately in your browser.
This tool decodes tokens only. It does not verify signatures, and your token never leaves your device.
✓ Free to use · No signup required · Processed in your browser
JWT Decoder workspace
PASTE A TOKEN · DECODE · REVIEW CLAIMS AND EXPIRY
Paste a JSON Web Token to see what is inside it.
This tool only decodes the token. It does not verify the signature, so a decoded token is not proof that it is genuine — always verify tokens on your server.
JWT DECODER WORKSPACEMOSANKIT / DEVELOPER TOOLS
THE BASICS
What Is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe string used to pass information between systems — most often to prove who a user is after they sign in. It has three parts separated by dots: a header, a payload of claims, and a signature.
The header and payload are just Base64URL-encoded JSON, so anyone can read them. A decoder turns them back into readable JSON so you can inspect what a token contains.
BUILT FOR THE JOB
Key Features of MoSanKit JWT Decoder
Readable Dates
exp, iat and nbf claims are shown as real dates, in UTC and your local time, with how long ago or from now.
Expiry Status
Instantly see whether the token is valid, expired or not valid yet.
Security Notes
Get warnings for unsigned tokens (alg: none), empty signatures and tokens with no expiry.
Common Claims Explained
Issuer, subject, audience and other standard claims are labelled in plain language.
Private by Design
Decoding happens locally. Your token is never sent to a server.
QUICK AND SIMPLE
How to Decode a JWT
01 / PASTE
Paste your token
Paste the JWT, with or without the "Bearer " prefix.
02 / DECODE
Click Decode token
The header, payload and signature appear immediately.
03 / REVIEW
Check the claims
Look at the expiry status, dates and any warnings.
04 / COPY
Copy what you need
Copy the header or payload JSON for your notes or tests.
MADE FOR EVERYDAY WORK
Who Can Use This Tool?
Backend DevelopersCheck what an auth server put into a token.
Frontend DevelopersDebug sessions and permissions in single-page apps.
QA EngineersVerify claims and expiry during testing.
Security ReviewersSpot weak settings such as unsigned tokens.
DevOps EngineersTroubleshoot service-to-service authentication.
StudentsLearn how JSON Web Tokens are structured.
GOOD TO KNOW
A few things, answered.
Quick answers about using the MoSanKit JWT Decoder.
No. It only decodes the token. A decoded token is not proof that it is genuine — always verify signatures on your server with the correct key.
The decoding runs entirely in your browser and the token is never uploaded. Even so, avoid pasting live production tokens into any website you do not control — use a test token where you can.
JWT payloads are encoded, not encrypted. Never put secrets such as passwords in a JWT payload.
exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds.
It means the token is unsigned. A server must never accept such a token for authentication.
No. Encrypted tokens have five parts and cannot be read without the decryption key.
KEEP BUILDING
Explore More Developer Tools
See what is inside
your token.
Explore more free developer tools from MoSanKit.