🔑 JWT Decoder
Decode JWT header, payload and signature locally, check expiry and see claims — nothing is uploaded.
🔐 The token is decoded entirely in your browser and never sent to 0Appz or any third party. Keep in mind that JWTs can contain sensitive data.
📦 Header
—
📄 Payload
—
✍️ Signature
—
The signature is shown as-is. This tool does not verify signatures, so do not treat a decoded token as trusted.
⏱️ Time claims
How to use this tool
Overview
JWT Decoder - Free Online JSON Web Token Decoder decodes any JSON Web Token straight in your browser. Paste a token and instantly see its three parts: the header (signing algorithm, type, key ID), the payload (all claims as formatted JSON) and the raw signature. Time-based claims are translated into human-readable dates, and the tool tells you whether the token is valid, expired, not yet valid or has no expiration at all. Everything runs client-side — your token is never uploaded, which matters because JWTs often carry session identifiers and personal data. Note that decoding does not verify the signature: for that you need the secret or public key.Frequently asked questions
Is it safe to paste a JWT here? +
Yes. The JWT Decoder - Free Online JSON Web Token Decoder decodes the token entirely in your browser with JavaScript — nothing is uploaded. Still, remember that anyone with the token can read its payload, so avoid pasting production tokens on shared computers.
Does this tool verify the signature? +
No. It decodes the header and payload and displays the signature as-is. Verifying a signature requires the secret or public key, and a decoded token should never be trusted on its own.
Why does my token show as expired? +
The exp claim is a Unix timestamp in seconds. If that time is in the past, the token is expired and should be refreshed by the issuing service.
What do alg, typ and kid mean? +
alg is the signing algorithm (for example HS256 or RS256), typ is usually JWT, and kid identifies which key was used to sign the token.