JWT Decoder
Decode and inspect JWT tokens instantly. See header, payload, and signature in a readable format. Checks expiry automatically. No signup required.
What is JWT Decoder?
The JWT Decoder instantly breaks down any JSON Web Token into its three components: header, payload, and signature. Paste your token and see the algorithm, token type, claims, expiry time, and all custom fields in clean, readable JSON — no manual base64 decoding needed.
JWTs are everywhere in modern web development — OAuth flows, API authentication, session management. When debugging auth issues, you need to quickly check what's inside a token: is it expired? Does it have the right claims? What algorithm was used to sign it? This tool gives you that answer in one paste.
The decoder runs entirely in your browser. Your token is never sent to any server. For security, this tool only decodes the token — it does not verify the signature, as that requires the secret key.
How to use
Frequently asked questions
No. Signature verification requires the secret key or public key used to sign the token, which this tool does not have. Only your server should verify signatures. This tool decodes the visible claims only.
The token is decoded entirely in your browser and never sent to any server. That said, treat JWTs like passwords — avoid pasting production tokens containing sensitive data into any online tool if possible.
The header contains metadata about the token — typically the signing algorithm (e.g. HS256, RS256) and the token type (JWT).
'exp' is the expiration time claim — a Unix timestamp indicating when the token expires. The tool converts this to a human-readable date and shows whether it has expired.
A JWT must have exactly three dot-separated parts. If your token is truncated, has extra characters, or is not a valid JWT format, it will show an error.