JWT Decoder
Decode and inspect JSON Web Tokens (JWT) instantly. View header, payload, claims, and check token expiry status. No data sent to any server.
How to Use
- 1
Paste your JWT
Copy a JWT token from your app or API response and paste it into the input.
- 2
Inspect the token
The Header, Payload, and Signature sections are decoded and displayed instantly.
- 3
Check expiry
The status bar shows whether the token is valid or expired, plus the issue and expiry times.
How It Works
This tool decodes a JSON Web Token (JWT) to reveal its header, payload, and expiry status, running entirely in your browser — useful for debugging authentication issues or inspecting what claims a token actually contains.
The three parts of a JWT
A JWT is three Base64-encoded segments separated by dots: a header (specifying the signing algorithm), a payload (the actual claims — user ID, roles, expiry time, etc.), and a signature (used to verify the token hasn't been tampered with). This tool decodes and displays the header and payload as readable JSON.
Why this tool can't verify the signature
Verifying a JWT's signature requires the secret key (or public key, for asymmetric signing) that was used to sign it — a value that's deliberately kept private by whoever issued the token. Without that secret, this tool can decode and display the token's contents, but it cannot confirm the token hasn't been tampered with or forged — that verification step has to happen server-side, where the secret is actually available.
Examples
Debugging an authentication issue
Decoding a JWT received from a login API to check whether the expected claims (like user role or expiry time) are actually present and correctly formatted in the payload.
Checking token expiry
Decoding a JWT and checking its `exp` (expiration) claim against the current time to understand why an API request might be failing with an "expired token" error.
Common Use Cases
- Debugging authentication and authorization issues during API development
- Inspecting what claims and expiry time a JWT actually contains without server-side tooling
- Learning how JWTs are structured for educational purposes
Tips
- Decoding a JWT here only shows you its contents — it does not prove the token is valid or hasn't been tampered with, since that requires signature verification with the secret key, which only your backend should have.
- Never paste a JWT containing sensitive production credentials into any third-party tool as a general practice — this tool processes everything locally in your browser with nothing sent to a server, but it's a good habit to verify that's true of any token-inspection tool you use, since tokens can carry real access rights.
Frequently Asked Questions
Related Tools
JSON Formatter & Validator
Format, beautify, and validate JSON instantly. Minify for production or pretty-print for readability. Error highlighting included.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 strings back to plain text. Supports Unicode and URL-safe Base64.
URL Encoder / Decoder
Encode special characters in URLs or decode percent-encoded URLs. Handles full URLs and individual query parameters.