JWT Decoder
Decode JWT tokens to inspect header and payload claims (client-side only).
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Private & SecureRuns in your browser — nothing is uploaded
Easy to UseJust paste or type — instant results
Free ForeverUnlimited use, no sign-up
Fast & ReliableAdvanced tech, fast and stable
A JWT looks like one long, unreadable string, but it is just Base64. Paste one in and you can read what is actually inside: who issued it, who it is for, and when it expires. The decoding happens in your browser, and nothing is sent.
How to use: JWT Decoder
- 1Enter inputPaste your full JWT (three dot-separated parts) into the input box.
- 2Set optionsThe tool Base64Url-decodes it and shows the header and payload separately.
- 3ProcessReview the claims such as issuer, expiry (exp) and whether it has expired.
- 4Get resultCopy the decoded JSON result in one click for debugging or inspection.
Common use cases
Debug a loginWhen a session keeps getting rejected, reading the issued-at and expiry times often shows you why.
Inspect the claimsSee the user id, roles or scopes a backend placed inside the token.
Check expiryCompare the exp field to know whether a token is still valid or already past its time.
Understand a third-party tokenBefore you rely on an external API token, see exactly what it grants.
Good to know
It decodes, it does not verifyThe tool reads the header and payload but does not check the signature, so a token that decodes is not automatically a trusted one.
Times are in secondsexp and iat are Unix seconds, not milliseconds; the tool converts them to readable dates for you.
Three parts, one dot eachHeader, payload and signature are joined by dots. Only the first two are readable; the third is a hash.
Do not paste tokens you do not ownEven though everything stays local, treat any production token as sensitive information.