JWT Decoder

Decode and inspect JSON Web Tokens. View header, payload, and signature without verification.

Runs in your browser · Data never leaves your device
alg + typ 

            

            

                

                    
                    claims
                

                

            

            

                

                    
                    verify
                

                

            

        


        
Decoding is done entirely in your browser. The signature is not verified — do not trust claims without server-side verification.


    


    
    


    
        

        
What is a JWT Decoder?

        
A JSON Web Token (JWT) is a compact, URL-safe token format widely used for authentication and information exchange between parties. A JWT consists of three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims such as user ID, roles, and expiry), and a signature. This tool decodes and displays the header and payload of any JWT so you can inspect its claims — such as iss (issuer), sub (subject), exp (expiration), and custom fields — without needing your secret key. Decoding is completely local to your browser and no tokens are transmitted anywhere.

    

    
    
        

        
How to use this tool

        
    
                        
  1. Paste your JWT string (the three-part dot-separated token) into the Token input field.
    2. 
                        
  2. The tool instantly decodes and displays the Header and Payload as formatted JSON.
    3. 
                        
  3. Check the exp claim to see when the token expires (displayed as a human-readable date).
    4. 
                        
  4. Review the alg claim in the header to see which signing algorithm was used (e.g., HS256, RS256).
    5. 
                        
  5. Note: this tool decodes the token only — it does not verify the signature. Always verify signatures server-side.
    6. 
                    

    

    
    
        

        
Common use cases

        
    
                        
  • Inspecting JWT tokens during API development or debugging authentication flows
    • 
                        
  • Checking token expiration (exp claim) to diagnose "token expired" errors
    • 
                        
  • Reading custom claims from tokens received from third-party identity providers (Auth0, Okta, Cognito)
    • 
                        
  • Understanding the structure of JWTs for onboarding new team members
    • 
                        
  • Quickly extracting user ID or role information from a token during testing
    • 
                    

    

    
    
        

        
Frequently asked questions


        
        

        

                        

                
Is it safe to paste my JWT here?

                
The JWT payload is decoded entirely in your browser — nothing is sent to our servers. However, JWTs can contain sensitive claims. If your token carries personal data, be cautious about pasting it on any public website. For testing, use short-lived or revoked tokens.

            

                        

                
Does this tool verify the JWT signature?

                
No. Signature verification requires your secret or public key and should always be done server-side. This tool only decodes the Base64URL-encoded header and payload to make them readable.

            

                        

                
Why do JWTs have three parts separated by dots?

                
The three parts are: (1) the header — Base64URL-encoded JSON with the token type and algorithm; (2) the payload — Base64URL-encoded JSON with the claims; and (3) the signature — a cryptographic hash of the header and payload, used to verify integrity.

            

                        

                
What does "exp" mean in the JWT payload?

                
"exp" is the expiration time claim — a Unix timestamp indicating when the token stops being valid. Most JWTs are short-lived (minutes to hours) for security reasons. This tool converts the exp timestamp to a human-readable date for easy inspection.