Decode Bearer Token Online
Paste the token from your Authorization header and read its header, payload, and claims. The expiry shows as a live countdown, and the signature can be checked against a secret or a public key, all without the token leaving your device.
JWT Decoder
LOCAL · Browser-OnlyDecode and inspect JSON Web Tokens without sending them to a server
Quick Start
- 1Copy the token from your Authorization header, without the word Bearer
- 2Paste it in to decode the header and payload
- 3Read the claims and the expiry countdown
- 4Optionally add a secret or public key to verify the signature
What This Tool Does
A bearer token in an Authorization header is almost always a JWT: three base64url segments separated by dots. Pasting it here splits those apart and shows the header, the payload as readable JSON, and the signature as hex bytes.
The payload is separated into registered claims (issuer, subject, audience, expiry, not-before, issued-at and token id), each with a description of what it means, and everything else as custom claims. Timestamps appear as both the raw number and a readable local time, and a live countdown says how long the token has left.
The signature can actually be verified, on your own device, using the browser's cryptography. HMAC with a shared secret, RSA and RSA-PSS with a public key, and ECDSA with a public key are all supported. Verification is optional: decoding works with no key at all.
Limits Worth Knowing
- Paste the token on its own. The word Bearer and the space after it are not stripped for you, and leaving them in produces a format error.
- A validation panel flags what makes a token untrustworthy: an algorithm of none, an expiry already past, a not-before in the future, or an expiry that is not after the issue time.
- Public keys must be in the standard PEM form. There is no import from a key set URL.
- The EdDSA algorithm is recognized and named but cannot be verified here.
- Decoding is not the same as trusting. Anyone can read a JWT payload, which is exactly why nothing sensitive belongs in one.
Common Questions
Do I paste the whole header value?
Does it check the signature?
Is my token sent anywhere?
More Decode Tools
All decoders →Decode a Punycode (xn--) Domain Online
Paste an xn-- domain and see the real Unicode name behind it. Spot IDN homograph and phishing lookalikes. Free decoder that runs in your browser.
Decode Base64 to Text Online
Decode Base64-encoded strings back to readable text. Free online Base64 decoder with UTF-8 support.
URL Decode Percent-Encoded Text Online
Decode percent-encoded URL strings back to readable text. Free online URL decoder for query strings and URIs.
Decode JWT Tokens Online
Decode and inspect JWT token headers and payloads without verification. Free online JWT decoder with claim analysis.
Decrypt AES-256 Encrypted Text Online
Decrypt AES-256-GCM encrypted Base64 ciphertext back to plaintext. Free online AES decryption tool.
Decode Caesar Cipher Online - Brute Force All Shifts
Decode Caesar cipher text by trying all 26 shift values. Free online Caesar cipher decoder and cracker.
Looking for FAQs and advanced options? Visit the full JWT Decoder page →