JWT Decoder
Decode JWT header and payload — inspect claims without verifying signatures.
- 100% client-side · your data never leaves your browser
- Instant, no rate limits
- Free, no sign-up
—
—
Decodes header and payload only. Does not verify signatures.
Overview
JWT Decoder — Inspect Header and Payload Online
Decode JSON Web Tokens (JWTs) and view the header and payload as formatted JSON. See algorithm (alg), issuer, audience, expiry (exp), and custom claims without sending your token to a third-party service. JsonDrift decodes only — it does not verify signatures or trust the token.
JWT structure
A JWT has three Base64url-encoded parts separated by dots: header, payload, signature. The header typically contains typ and alg. The payload holds claims — registered names like exp, iat, sub plus application-specific fields.
Reading standard claims
The payload usually contains registered claims you can check at a glance: sub (subject/user), iss (issuer), aud (audience), exp (expiry), iat (issued-at), and nbf (not-before). Times are Unix seconds, so an exp in the past means the token is expired. Decoding the payload is the quickest way to answer 'who is this token for and has it expired?' while debugging auth.
Security note
Decoding is not authentication. Anyone can read a JWT payload — it is only Base64url-encoded, not encrypted — so never store secrets in a JWT. Signature verification must happen on your server with the correct key; this tool helps you inspect tokens during development, not make authorization decisions.
Debugging auth failures
When a request is rejected, decode the token to check the obvious causes before digging into server logs: an expired exp, the wrong aud or iss for the service, a missing scope or role claim, or an unexpected alg in the header. Seeing the decoded header and payload side by side usually points straight at the problem.
FAQ
Frequently asked questions
How do I decode a JWT?
Paste the token and JsonDrift Base64url-decodes the header and payload into formatted JSON so you can read the algorithm and claims. It runs entirely in your browser.
Does this verify the signature?
No. It only decodes the header and payload for inspection. Signature verification must happen server-side with the signing key.
Is my token uploaded?
No. Decoding runs entirely in your browser, so tokens never leave your machine.
How do I know if a JWT is expired?
Check the exp claim in the decoded payload — it's a Unix timestamp in seconds. If it's earlier than the current time, the token has expired.
Continue with a related tool
All tools- JSON Analyzer & Parser
Analyze JSON structure — depth, key counts, types, and top-level fields at a glance.
- JSON5 Validator & Converter
Validate JSON5 with comments and unquoted keys, then convert to strict JSON.
- JSON Repair & Fix
Fix invalid JSON: trailing commas, quotes, unquoted keys, and LLM markdown fences.
- JSON Validator
Validate JSON instantly with precise, human-readable error messages and line numbers.
- JSONL Validator & Formatter
Validate and format JSON Lines — one JSON object per line.
- AI JSON Token Counter
Estimate the LLM token count of a JSON payload for context budgeting.