JWT Decoder
Decode any JSON Web Token (JWT) to inspect the header, payload claims and expiry date — all in your browser, nothing uploaded.
Header
Payload
Signature
Signature verification requires the secret/public key — not shown here.
How to use
- Paste your JWT token into the input box.
- Click Decode to see the header and payload as formatted JSON.
- Check the expiry date and signature section — note that signature verification requires the secret key.
Frequently asked questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and information exchange. It has three parts separated by dots: header (algorithm), payload (claims) and signature.
Is my token safe to paste here?
The decoding runs entirely in your browser — your token is never sent to any server. However, treat JWTs like passwords: avoid pasting production tokens into any online tool if they grant access to sensitive resources.
Can this verify the signature?
No. Signature verification requires the secret key (for HMAC) or the public key (for RSA/ECDSA), which only your server should have. This tool decodes the header and payload only.
What is the exp claim?
The exp (expiration) claim is a Unix timestamp indicating when the token expires. The decoder shows the human-readable date and whether the token has already expired.
Why does my token show as invalid?
A valid JWT has exactly three parts separated by dots, each Base64url-encoded. If your token is truncated, has extra characters or is not a JWT at all, decoding will fail.