JWT Decoder
Decode and inspect JSON Web Tokens (JWT). View header, payload, claims, and expiry status. Free and private.
How to Use
- 1. Paste your JWT token in the input field (format: header.payload.signature).
- 2. The decoder automatically parses the token as you type.
- 3. View the decoded Header (algorithm, token type) and Payload (claims, user data).
- 4. Check the expiry status — the tool shows if the token is expired.
- 5. Click Copy to copy header or payload JSON.
About This Tool
JSON Web Tokens (JWTs) are a widely adopted standard (RFC 7519) for securely transmitting information as a JSON object. They are used in authentication systems, authorization flows, and API security — found in virtually every modern web application.
A JWT has three parts separated by dots: the header specifies the signing algorithm (such as HS256 or RS256); the payload contains the claims (user ID, expiry time, roles, and any custom data); and the signature is a cryptographic hash used to verify the token hasn't been tampered with.
The header and payload are only base64url-encoded, not encrypted — meaning anyone who gets a token can read the header and payload. This is by design: the claims inside are meant to be readable. The signature is what proves the token was issued by a trusted party.
This tool decodes and displays the header and payload in human-readable JSON format. It also detects the exp claim and shows whether the token has expired. Since signature verification requires the secret key or public certificate, this tool intentionally skips that step.
All decoding happens entirely in your browser using pure JavaScript — base64url decode followed by JSON parse. Nothing is transmitted to any server. This tool is ideal for debugging authentication issues during development.
You may also find our Base64 Encode / Decode, Hash Generator, and JSON Formatter helpful.
Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. It consists of three base64url-encoded parts: header, payload, and signature, separated by dots.
Is this tool safe to use with real tokens?
The tool only decodes the header and payload — it does not validate the signature, and nothing is sent to any server. However, avoid pasting production tokens containing sensitive data into any online tool as a best practice.
Can this tool validate JWT signatures?
No. Signature validation requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA). This tool only decodes the header and payload, which are publicly readable.
What is the exp claim?
The "exp" (expiration time) claim identifies the time after which the JWT must not be accepted. It is a Unix timestamp (seconds since January 1, 1970).
What is base64url encoding?
Base64url is a variant of base64 encoding that is URL-safe: it replaces + with - and / with _, and omits the = padding character. JWTs use base64url for the header and payload parts.
Was this tool helpful?
More Tools
Related Security
TOTP Generator
File Checksum Verifier
Barcode Generator
QR Code Scanner
You Might Also Like