JWT Decoder - Debug JSON Web Tokens Online

Loading tool…

Debug JWTs Securely

JSON Web Tokens (JWT) are an open, industry standard RFC 7519 method for representing claims securely between two parties. This tool allows you to decode a JWT string and view its three components: Header, Payload, and Signature.

Decode Header & Payload: Instantly see the data inside your token.
Human-Readable Dates: Automatically converts 'exp', 'iat', and 'nbf' timestamps into readable dates.
Expiration Check: Visually check if a token is valid or expired.
Privacy First: We do not ask for your private key, and your token never leaves your browser.

Why QodeCat?

Client-Side Only

Most online decoders send your token to a backend server. This is a security risk for production tokens. QodeCat performs all decoding logic right here in your browser using JavaScript.

Common Questions

Q. Can I read a JWT if I don't have the secret?

Yes. JWTs are encoded (Base64), not encrypted. The data in the payload is visible to anyone who possesses the token. The 'secret' is only needed to verify that the data hasn't been changed, not to read it.

Q. Why don't you ask for my Secret Key?

For your security. Pasting your private signing key (HMAC secret or Private Key) into any website is dangerous. Since this tool is for debugging the *content* of the token, we decode it without verifying the signature.

Q. What is 'exp'?

The 'Expiration Time' claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing.

Q. What is 'iat'?

The 'Issued At' claim identifies the time at which the JWT was issued.