JWT Decoder

Decode a JSON Web Token to read its header, payload and expiry - entirely in your browser.

token.jwt

About the JWT Decoder

Decode a JSON Web Token to inspect its header and payload claims - entirely in your browser.

🛠️
How to use it
  1. Paste a JWT into the token box - it decodes as you type (a leading "Bearer " is removed).
  2. The banner shows whether the token has expired; dates in iat, nbf and exp are converted to readable times.
  3. Copy the decoded header or payload as formatted JSON, or click Load Sample to try an example.
💡
Tips & use cases
  • Decoding happens entirely client-side - the token is never sent to any server.
  • This tool only decodes the token; it does not verify the signature, so a valid-looking decode doesn't mean the token is authentic.
  • See our What is a JWT? guide for a full explanation of JWT structure.

Decode JSON Web Tokens Online

A JWT is three Base64URL-encoded parts separated by dots. Paste a token to read its header and payload as JSON and to see its timestamps as real dates.

📐

What is inside a JWT

  • Header: the signing algorithm (alg) and token type (typ).
  • Payload: the claims, such as subject (sub), issuer (iss), audience (aud) and any custom data.
  • Time claims: iat (issued at), nbf (not before) and exp (expiry) are Unix timestamps, shown here as readable dates.
  • Signature: proves the token was issued by the holder of the key. It can only be checked with that key.
📦

Common reasons to decode a JWT

  • Finding out why an API returns 401 - often an expired token
  • Checking the roles, scopes or permissions a token carries
  • Confirming issuer and audience while setting up OAuth or OpenID Connect
  • Learning how JWT-based authentication works

JWT Decoder FAQ

Is it safe to paste my token here?

The token is decoded in your browser and is not sent anywhere. Even so, a valid token is a credential - avoid pasting production tokens into any website you don't trust, and prefer expired or test tokens when you can.

Does this tool verify the signature?

No. It only decodes. Verifying needs the secret or public key and should be done by your server or an auth library. A token that decodes cleanly is not necessarily authentic.

Can anyone read the contents of a JWT?

Yes. A standard signed JWT is encoded, not encrypted, so anyone holding the token can read its payload. Never put passwords or other secrets in it.

How do I know if a token has expired?

The banner above the decoded output says so, and the exp claim is shown as a date and time.

🔗