JWT Decoder API

Decode and inspect JSON Web Tokens online. View header, payload, claims and expiry — with optional HMAC (HS256/384/512) signature verification. 100% client-side.

The JWT Decoder is also available as a free REST API. Send a POST request with a JSON body to https://dot.tools/api/tools/jwt-decoder — no authentication, no API key, CORS enabled. Successful calls return { "ok": true, "result": { … } }; failures return HTTP 400 or 422 with an error body.

Request body

Field	Type	Required	Description
`token`	string	required	The JSON Web Token to decode (header.payload.signature).

Response

Field	Type	Required	Description
`header`	object	required	Decoded JWT header claims.
`payload`	object	required	Decoded JWT payload claims.
`signature`	string	required	Raw base64url signature segment.
`algorithm`	unknown	required	Signing algorithm from the header (alg claim), if present.
`validity`	"valid" \| "expired" \| "not-yet-valid" \| "no-expiry"	required	Time-based validity based on exp/nbf.
`issuedAt`	unknown	required	ISO-8601 rendering of the iat claim, if numeric.
`expiresAt`	unknown	required	ISO-8601 rendering of the exp claim, if numeric.
`notBefore`	unknown	required	ISO-8601 rendering of the nbf claim, if numeric.

Example request

curl -X POST https://dot.tools/api/tools/jwt-decoder \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfMDFKNVIiLCJuYW1lIjoiQml0Z2F0ZSBEZXYiLCJlbWFpbCI6ImRldkBiaXRnYXRlLmNvbSIsImlzcyI6Imh0dHBzOi8vYXV0aC5iaXRnYXRlLmNvbSIsImlhdCI6MTc1NTcxMjAwMCwiZXhwIjoxOTg3MTY4MDAwfQ.8xwZhXWxbZVLHZvWVbLZYVZXJZVZXJZVZXJZVZXJZVk"
}'

Sample response

{
  "ok": true,
  "result": {
    "header": {
      "alg": "HS256",
      "typ": "JWT"
    },
    "payload": {
      "sub": "usr_01J5R",
      "name": "Bitgate Dev",
      "email": "dev@bitgate.com",
      "iss": "https://auth.bitgate.com",
      "iat": 1755712000,
      "exp": 1987168000
    },
    "signature": "8xwZhXWxbZVLHZvWVbLZYVZXJZVZXJZVZXJZVZXJZVk",
    "algorithm": "HS256",
    "validity": "valid",
    "issuedAt": "2025-08-20T17:46:40.000Z",
    "expiresAt": "2032-12-20T15:06:40.000Z",
    "notBefore": null
  }
}

Use the free JWT Decoder in your browser, read the JWT Decoder guide, or import the full OpenAPI specification.