How to Decode and Inspect JWT Tokens Online
JSON Web Tokens (JWTs) are a widely used standard for securely transmitting information between parties as compact, self-contained JSON objects. When debugging authentication issues or understanding what claims are in a token, you need to decode the JWT to view its contents. This guide shows you how to decode and inspect JWT tokens using fixie.tools — a free browser-based decoder with no signup required and complete client-side processing for security.
Step 1: Open the JWT Decoder Tool
Navigate to fixie.tools/jwt in your web browser. The tool runs entirely in your browser with no server communication, ensuring your tokens remain private. No account creation or registration is needed. Works on all devices and supports all modern browsers.
Step 2: Paste Your JWT Token
Copy your JWT token from wherever it's stored — browser cookies, API responses, authentication headers, or local storage. Paste the complete token (all three Base64-encoded parts separated by dots) into the token input field. The tool automatically detects and parses the JWT structure. If the token is invalid or malformed, you'll see an error message explaining the issue.
Step 3: View Decoded Header and Payload
Once pasted, the tool instantly decodes the JWT and displays the header and payload sections in human-readable JSON format. The header shows the token type (typ) and signing algorithm (alg) like HS256, RS256, or ES256. The payload contains claims — standard claims like issuer (iss), subject (sub), expiration (exp), issued-at (iat), and any custom claims your application added. All Base64 decoding happens locally in your browser for complete privacy.
Step 4: Check Token Expiration and Timing
Review the timing claims to understand token validity. The exp (expiration) claim shows when the token expires as a Unix timestamp. The iat (issued at) claim shows when the token was created. The nbf (not before) claim, if present, indicates when the token becomes valid. The tool displays these timestamps in both Unix format and human-readable date/time, making it easy to verify if a token is expired or not yet valid. Expired tokens will be clearly marked with a warning.
Step 5: Copy Decoded Claims or Validate Signature
Use the copy button to copy individual claims or the entire decoded payload for debugging or documentation. If you have the signing secret or public key, you can optionally paste it into the signature verification field to validate the token's authenticity. Signature verification proves the token hasn't been tampered with and was issued by the expected authority. For debugging purposes, you can inspect tokens without verification — the tool will still decode the content even for unsigned or invalidly-signed tokens.