JWT Decoder
Decode a JSON Web Token and inspect its header and payload, entirely in your browser.
A JWT, or JSON Web Token, is a compact, three-part string commonly used to carry authentication and session data between a client and a server. Each token is made of a header, a payload, and a signature, separated by dots, with the header and payload both being Base64-encoded JSON objects.
Paste a JWT into the box and click Decode. The tool splits the token into its three parts and decodes the header and payload back into readable JSON, and if the payload includes an expiration claim, shows whether the token has expired.
This tool only decodes a token, it does not verify the signature, since that requires the secret or public key used to sign it. This is useful for inspecting what claims are inside a token during development, debugging an authentication issue, or checking when a token expires without needing the server's signing key.
Does this verify the token's signature?+
No, verifying a signature requires the secret or public key that was used to sign the token, which this tool does not have. It only decodes the readable parts.
Is my token sent to a server?+
No. Decoding happens entirely in your browser using JavaScript. Nothing is uploaded anywhere.
Why does the payload show an exp field?+
The exp claim is a Unix timestamp indicating when the token expires. This tool converts it into a readable date and tells you if it has already passed.
What if my token has more or fewer than three parts?+
A valid JWT always has exactly three dot-separated parts. If yours does not, it is not a properly formatted JWT.