JWT Decoder Online (Free, Private)

JWTs are Base64URL-encoded JSON with three parts: header, payload, and signature. Decoding lets you inspect claims like exp, sub, and roles — essential for debugging auth flows.

Decode tab — inspect claims

• Paste any JWT and see header and payload as formatted JSON
• Claims table with standard fields (iss, sub, exp, iat, aud)
• Expiry badge — see at a glance if the token is expired or still valid
• Copy individual sections or the full decoded output

Verify tab — check signatures

• HMAC algorithms: HS256, HS384, HS512 with a shared secret
• RSA algorithms: RS256, RS384, RS512 with a PEM public key
• Instant valid/invalid result — no server round-trip

Important security note

Decoding alone does not verify the signature. Never paste production JWTs into server-side decoders — they may log tokens. Utiliio processes everything in your browser.