JWT Decoder
Paste a JSON Web Token to read its header and payload. This tool decodes only — it does not verify the signature, so a token that decodes here is not proven genuine.
What is a JWT Decoder?
A JSON Web Token (JWT) has three parts separated by dots: header, payload, and signature. The header and payload are Base64URL-encoded JSON, which means anyone can read them — they are encoded, not encrypted. The header usually names the signing algorithm (alg) and the token type (typ), while the payload carries claims such as the user id (sub), the issued-at time (iat), and the expiry time (exp).
This decoder reads those first two parts and shows them as pretty-printed JSON. If the payload contains an exp claim, the tool converts that Unix timestamp (in seconds) into a date in your local time zone and tells you whether the token has already expired. That is the whole job: it helps you debug tokens during development by showing exactly what a token claims, without needing server access.
How to use the JWT Decoder
1. Paste the complete token — all three parts, dots included — into the input box, or click Load example. 2. Click Decode. 3. Read the header and payload JSON, and check the expiry rows if an exp claim is present. 4. Remember the limit: decoding is not verification, so never treat a readable token as a trusted one.
Frequently asked questions
Does this tool verify the signature? No, and that is deliberate. Verifying a signature requires the issuer’s secret key, which must never be pasted into a browser page. Real signature verification belongs on the server that trusts the issuer.
Why does decoding fail? The usual cause is an incomplete copy: a token must have exactly three parts. Extra spaces, line breaks, or missing characters at either end will fail, as will a header or payload that is not valid Base64URL-encoded JSON.
How is the expiry date calculated? The exp claim is a Unix timestamp in seconds, converted to your local time zone. Expired or not is judged against the current time on your device. If there is no exp field, expiry simply cannot be judged — that does not mean the token lasts forever.
Is it safe to paste a real token here? Decoding runs entirely in your browser and nothing is uploaded, but a token is still a credential: anyone holding it can impersonate the session it belongs to. Prefer test tokens, and treat any pasted production token as exposed afterwards.
Related tools
Base64 Encode & Decode · Hash Generator · Timestamp Converter · JSON Formatter