JWT Decoder & Inspector
Paste a JWT to inspect its header and payload. Decoding happens locally — tokens are never sent anywhere.
A JSON Web Token (JWT) is the credential most APIs hand your browser after login — three Base64URL sections separated by dots: a header naming the signing algorithm, a payload of claims (who you are, when it expires), and a signature. Because the first two sections are encoded rather than encrypted, anyone holding the token can read them. This tool decodes them instantly so you can debug auth flows and check expiry — without pasting production tokens into an unknown website, because decoding runs entirely in your browser.
How to decode a JWT
- Paste the full token (all dot-separated sections) into the input box.
- Click Decode Token to see the decoded header and payload.
- If the payload contains
exporiatclaims, the tool also shows issue time, expiry time, and whether the token is currently valid. - Decode happens locally, so private tokens stay on your machine — nothing is transmitted.
What a decoded JWT looks like
Given this token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSIsImlhdCI6MTcwMDAwMDAwMH0.abc123the header and payload decode to:
// header
{
"alg": "HS256",
"typ": "JWT"
}
// payload
{
"sub": "1234567890",
"name": "Ada",
"iat": 1700000000
}Frequently asked questions
Does this tool verify the signature?
No — by design. Signature verification requires the secret or public key, which only your backend has. This tool reads the token contents; trust validation happens on your server.
Is decoding a JWT safe? Can you read my token?
Decoding is safe because JWTs are encoded, not encrypted — anyone with the token could already read it. Still, never paste production tokens into tools you don’t trust. This one runs the decode locally; the token is never transmitted.
Why does my token show "EXPIRED"?
The exp claim is a Unix timestamp after which the token must not be accepted. The tool compares it with your device’s clock and shows how long ago it lapsed.