JWT Decoder

Decode and inspect JSON Web Tokens directly in your browser.

Paste JWT

Header

Payload

Use this tool from AI agents

This tool's engine is available to AI agents over MCP as decode_jwt. Add the Clean.tools server, then your agent can call it directly.

Claude Code

claude mcp add --transport http clean-tools https://mcp.clean.tools/mcp

Claude Desktop (mcpServers)

{"mcpServers":{"clean-tools":{"command":"npx","args":["-y","@clean-tools/mcp"]}}}

Cursor

https://mcp.clean.tools/mcp

Or call it over plain HTTP from any script. Same engine, JSON in and JSON out, no key:

curl

curl -s https://api.clean.tools/v1/decode_jwt \
  -H 'content-type: application/json' \
  -d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"}'

JavaScript

const res = await fetch('https://api.clean.tools/v1/decode_jwt', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' })
});
const data = await res.json();

OpenAPI spec npm: @clean-tools/mcp Full developer guide

How it works

This JWT decoder splits the token on its dot separators, then base64url-decodes the header and payload segments. The decoded JSON is formatted for easy reading. If the payload contains an exp (expiration) claim, the tool displays whether the token is still valid or has expired, along with the exact expiration timestamp.

Everything runs locally in your browser. Your tokens are never sent to any server. No signup, no tracking. Works on any modern browser, on both mobile and desktop.

You can also run the same decoder from scripts or AI agents through the decode_jwt tool on the Clean.tools API, or by adding the @clean-tools/mcp MCP server from npm to Claude or Cursor.

Frequently asked questions

Does this decoder verify the signature?

No. It only decodes the header and payload so you can read their contents. Verifying the third segment requires the signing secret or public key, which this tool never asks for and never has. A decoded token is not a validated token.

Why does a token show as "Valid" when I expected it to fail?

The Valid and Expired badge reflects only the exp claim compared against your device clock. It does not check the signature, the nbf not-before time, or the audience, so a token can read as "Valid" here yet still be rejected by a real server.

Are the timestamps in my local time or UTC?

All iat, nbf, and exp times are shown in UTC. JWT dates are stored as NumericDate seconds since the Unix epoch; if an issuer wrongly emits milliseconds, the tool detects the larger value and adjusts so the date still reads correctly.

Can it decode encrypted (JWE) tokens?

No. This handles signed JWS tokens with a base64url-encoded JSON header and payload. Encrypted JWE tokens have five segments and a ciphertext payload, so they cannot be read without decryption keys.

Can I use this from the command line or an AI agent?

Yes. The same decoder is available over HTTP at https://api.clean.tools/v1/decode_jwt, so you can POST a token from curl or any script and get JSON back. It is also an MCP server you can add to Claude, Claude Code, or Cursor, and the @clean-tools/mcp npm package runs it as a local stdio server for offline use.

More tools from Clean.tools

View all tools

Use Clean.tools from your AI agent

This tool is also decode_jwt on the Clean.tools MCP server — the same engine, callable by your AI agent directly. No key, no signup: requests are processed in memory and request contents are never stored.