JWT Decoder
Decode JWT headers, payloads, and claims — entirely in your browser.
Decoding a JWT does not verify its signature. Do not treat decoded contents as trusted.
Never paste production secrets or sensitive credentials into tools you do not trust.
JWT Input
What is the JWT Decoder?
The JWT Decoder splits a JSON Web Token into its three parts — header, payload, and signature — and decodes the Base64URL-encoded header and payload into readable JSON. It also summarizes standard claims like issuer, subject, issued-at, and expiration, and tells you whether the token is expired or how long it remains valid.
JWTs are the backbone of modern API authentication (OAuth 2.0, OpenID Connect), and inspecting them is a constant need when debugging auth flows. Because decoding happens entirely in your browser, tokens never leave your machine — but you should still avoid pasting production credentials into any tool you don't fully trust.
Important: decoding a JWT does not verify its signature. Anyone can decode a JWT's contents; only cryptographic verification with the correct key proves it hasn't been tampered with. This tool does not perform signature verification and never claims a token is authentic.
How to use the JWT Decoder
- Paste a JWT (with or without the "Bearer " prefix) into the input.
- The header, payload, and signature are decoded and displayed instantly.
- Review the claim summary: algorithm, type, issuer, subject, issued-at, expiration, and not-before.
- Check the expiration status banner to see if the token is expired or still valid.
Examples
Decoded header
{
"alg": "HS256",
"typ": "JWT"
}Decoded payload
{
"sub": "1234567890",
"name": "Ada Lovelace",
"iat": 1716239022,
"exp": 4871912622
}Frequently asked questions
Does decoding verify that the token is valid?
No. Decoding only reveals the token's contents. A decoded token can still be forged or tampered with — only signature verification with the issuer's key proves authenticity, and this tool does not perform it.
Is it safe to paste a JWT here?
Decoding happens locally in your browser and the token is never transmitted or stored. That said, never paste production secrets or sensitive credentials into tools you do not trust.
Why are the times shown in UTC?
JWT time claims (exp, iat, nbf) are Unix timestamps in seconds. We display them as UTC dates and also compute a relative status (e.g. "expires in 3 hours") using your system clock.
What does an "Invalid token" error mean?
The input isn't a structurally valid JWT — it must be three Base64URL segments separated by dots, where the first two decode to JSON objects.
Related developer tools
JWT Generator
Create and sign JSON Web Tokens with HS256, HS384, or HS512.
Security & Encoding
Base64 Encoder / Decoder
Encode and decode Base64 text with full UTF-8 support.
Security & Encoding
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes with Web Crypto.
Security & Encoding
UUID Generator
Generate cryptographically secure UUID v4 identifiers in bulk.
Generators