JWT Decoder
Decode a JSON Web Token's header and payload in your browser. Nothing is uploaded.
Decoding only — the signature is not verified. Nothing is uploaded.
A JSON Web Token packs a header and payload into a compact, Base64URL-encoded string. JWT Decoder splits it apart and shows the readable header and payload in your browser — so you can inspect claims like expiry and subject while debugging, without your token ever leaving your device.
How to use jwt decoder
- 1. Paste your JWT.
- 2. Its header and payload are decoded and displayed.
- 3. Read the claims (issuer, subject, expiry and more).
When to use JWT Decoder
Debug authentication
See what claims a token carries when troubleshooting a login or API call.
Check expiry
Read the exp claim to confirm whether a token is still valid.
Inspect a payload
View the subject, roles or custom claims encoded in a token.
Decoding is not verifying
This shows what's inside a JWT, but it doesn't check the signature — anyone can read a token's payload. Never trust a decoded token as proof of anything on the client; the signature must be verified server-side with the secret or key. And because tokens are sensitive, it matters that this decoder runs entirely in your browser.
Reading the claims
In the payload, exp (expiry), iat (issued at) and nbf (not before) are Unix timestamps in seconds — paste them into the Unix Timestamp Converter to read the date. iss is who issued the token, sub who it's about, aud who it's for. In the header, alg names the signing algorithm, such as HS256 or RS256; a token with "alg": "none" isn't signed at all and should never be accepted by a server.
Tokens it can't read
A normal JWT has three parts separated by dots. One with five parts is an encrypted token (JWE): its payload is unreadable without the key, so the decoder reports it as invalid. An access token that doesn't start with "eyJ" is usually not a JWT at all — it's a reference only the issuing server can look up.
Frequently asked questions
Does it verify the token's signature?
No — it only decodes the header and payload for inspection. Signature verification must happen on the server with the key.
Is it safe to paste a real token here?
The decoding runs entirely in your browser and the token isn't uploaded, but treat any live token carefully regardless.
Why is the payload readable without a password?
A JWT payload is only Base64URL-encoded, not encrypted — its security comes from the signature, not secrecy.