All tools

JWT Decoder

JWT

Decode and inspect JWT tokens

Paste any JWT and its header and payload come back as readable JSON, with no signature check involved, which is the single most important caveat here: a token that decodes to valid-looking claims is not proof it was legitimately issued. It's built for inspection during integration work, like checking the `exp`/`iat` claims to debug an expiry issue, or confirming a third-party API is actually issuing the roles and scopes your backend expects, before you write any code around it. Decoding happens entirely client-side, so the token never leaves your machine, and expired tokens decode exactly the same as valid ones since this tool doesn't evaluate expiry at all. For signing rather than inspecting, use the companion JWT Signer tool.

jwttokendecodeauth

How to use JWT Decoder

  • 1.Paste any JWT to instantly see its decoded header and payload as readable JSON, without a signature check.
  • 2.Inspect the `exp` and `iat` claims to debug token expiry issues during API integration.
  • 3.Use it to verify a third-party API is issuing the claims (roles, scopes, subject) your backend expects before you write any code.

Frequently asked questions

Does this verify the JWT signature?
No — this tool only decodes and displays the header and payload. It does not verify the signature against a secret or public key, so a token showing valid-looking JSON is not proof it was legitimately issued.
Is my token sent anywhere?
No. Decoding happens entirely client-side in your browser; the token never leaves your machine.
Can I decode expired tokens?
Yes, expired tokens decode the same way as valid ones — this tool doesn't check expiry, it just shows you the raw claims.
What if I need to verify a signature?
Use the JWT Signer tool or the REST API /v1/tools/jwt-sign endpoint, which supports HS256/RS256 signing and can be adapted for verification in your own backend code.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/jwt-decode \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.abc"}'

Get an API key from your dashboard · Full API docs →

Related tools

JWT Builder (unsigned preview)Build a JWT header and payload preview with standard claims — unsigned, pair with JWT Signer to sign itJWTBase32 Encode / DecodeEncode and decode Base32 with Standard, Extended Hex, Crockford, and z-base-32 alphabetsEncode / DecodeBase58 / Base62 EncoderEncode and decode text as Base58 (Bitcoin-address style) or Base62 (alphanumeric, URL-safe)Encode / Decode