JWT Decoder
Decode and inspect JSON Web Tokens instantly. View the header, payload claims, and expiration status. Runs locally — nothing sent to any server.
Also searched as: token jwt · decode jwt · payload · claims · json web token · jwt inspect
This tool decodes the header and payload. Signature verification requires the secret key and is not performed — never paste tokens from production systems into online tools.
JSON Web Tokens (JWTs) are the backbone of modern authentication. When you log in to a web application, the server typically issues a JWT — a compact, self-contained credential that encodes your identity and permissions in a digitally signed string. Every JWT has three Base64URL-encoded sections separated by dots: the header (which algorithm was used to sign the token), the payload (the actual claims — who you are, when the token expires, who issued it), and the signature (which proves the token has not been tampered with). Decoding a JWT is essential for debugging authentication issues, understanding what data an API is communicating, and verifying token structure during development.
This decoder runs entirely in your browser. Your token never leaves your device — no network requests are made. That makes it safe to use with development and staging tokens. However, always exercise caution: avoid pasting production JWTs containing sensitive user data into any online tool, even privacy-respecting ones.
Paste your JWT (the full dot-separated string) into the input field at the top.
Review the decoded Header and Payload panels — standard claims are labeled and timestamps are shown in human-readable format.
Check the expiration status badge: green "Valid" means the token is active; red "Expired" means the exp claim is in the past.
What Is a JSON Web Token?
A JWT (JSON Web Token) is an open standard (RFC 7519) for transmitting structured information between parties as a digitally signed JSON object. The three parts are: the Header, which contains the token type and hashing algorithm (such as HS256 or RS256); the Payload, which contains claims — statements about the user and additional metadata including sub (subject), iss (issuer), aud (audience), exp (expiration), and iat (issued at); and the Signature, which is used by the recipient to verify the token was not altered in transit. Payload claims are not encrypted — they are only Base64URL-encoded, meaning anyone with the token can read them.
How to Use the Decoder
Paste your JWT token into the input field. The decoder instantly splits it into its three components and displays the decoded Header and Payload as formatted JSON. Standard claims like exp and iat are shown with human-readable timestamps and descriptive labels. If the token carries an exp claim, the tool compares it to the current time and shows an "Expired" or "Valid" status badge so you can immediately identify stale tokens.
Why Is This Useful?
JWTs are opaque strings that are difficult to inspect at a glance. During development, you often need to check whether a token has the correct claims, whether it has already expired, or which algorithm was used — all without writing custom decoding code or installing additional tools. This decoder gives you instant visibility into any JWT, making authentication debugging fast and friction-free. It is especially useful when integrating with OAuth 2.0 providers, debugging API 401/403 errors, or onboarding to a new codebase that uses token-based authentication.
Common Use Cases
Common uses include: inspecting tokens returned by identity providers like Auth0, Cognito, or Firebase Auth; checking whether an access token or refresh token has expired after a user session bug report; verifying that a custom claim (such as a role or tenant ID) is present in the payload; and confirming the signing algorithm matches what your backend expects. Development workflows that involve multiple environments benefit from having a quick way to compare token structures across dev, staging, and production.
Frequently asked questions
Is my JWT safe to paste here?
This decoder runs 100% in your browser — no data is ever sent to any server. The token you paste is processed entirely in JavaScript on your device. That said, treat production JWTs with real user data carefully regardless of the tool you use, since clipboard history and browser extensions can expose sensitive data without you noticing.
Does this tool verify the JWT signature?
No. Signature verification requires the secret key or public certificate that was used to sign the token. This tool only decodes the Base64URL-encoded header and payload sections, which do not require the key. The signature is displayed for reference but is not validated.
What JWT claims are shown with special labels?
The following registered claims are shown with descriptive labels: sub (Subject — user identifier), iss (Issuer — who created the token), aud (Audience — intended recipient), exp (Expiration Time — when the token expires), iat (Issued At — when it was created), nbf (Not Before — earliest valid time), and jti (JWT ID — unique token identifier for revocation).
What does it mean if my token shows as Expired?
It means the exp claim in the payload contains a Unix timestamp that is earlier than the current date and time. Expired tokens should be rejected by your API server. You will typically need to refresh the token using a refresh token or re-authenticate the user.
Can I decode tokens signed with RS256 or ES256?
Yes. The signing algorithm (HS256, RS256, ES256, etc.) only affects signature verification, not decoding. The header and payload are always Base64URL-encoded JSON regardless of the algorithm, so this tool decodes them the same way for any signing algorithm.