Inspect JWT tokens from Auth0, Firebase, Supabase, and custom OAuth2 providers. Decodes algorithm, issuer, subject, expiration time (exp), and custom claims.
Processed client-side in your browser — files never leave your device.
Free, with no signup, account, or usage limits.
Works on any modern browser, including mobile.
About this tool
JWT Decoder shows header and payload claims from a JSON Web Token. Inspect exp, sub, and custom claims while debugging auth — decoding is local (verification depends on options).
How to use
Paste the JWT string.
Inspect decoded header and payload claims.
Check expiry and audience fields when present.
Never paste production secrets into public tools you do not trust — this one runs locally.
FAQ
Is it safe to paste confidential JWT tokens here?
Yes! Unlike other online decoders, ThothBox runs 100% locally in your browser without transmitting tokens to any external server.