JWT Decoder
Decode a JWT token locally to inspect its header, payload, and common claims such as exp, iat, nbf, iss, aud, and sub. This tool is for inspection, not signature verification.
JWT Decoder tool
JWT format is usually header.payload.signature. This tool decodes the readable parts but does not verify the signature.
| Claim / Field | Value |
|---|
How JWT decoding works
A JWT is usually made of three dot-separated parts: header, payload, and signature. The first two parts are base64url-encoded JSON, which means they can be decoded and inspected without a secret key.
- Header: usually contains metadata such as the algorithm (
alg) and token type (typ) - Payload: contains claims such as subject, issuer, audience, issued-at time, and expiration time
- Signature: is used to verify authenticity, but this tool does not verify it
- Important: decoding a JWT is not the same as trusting it
Use this page for debugging token structure, checking expiration claims, reviewing API authentication data, or confirming that a token contains the expected fields.
Examples
- Header check: inspect whether a token uses an expected
algvalue such as HS256 or RS256 - Expiration check: decode
expto see when a token expires - Issuer check: inspect
issandaudclaims when debugging API authentication - Payload review: view custom claims in readable JSON format
FAQ
- What does this JWT decoder do?
It decodes the header and payload parts of a JSON Web Token and displays them as readable JSON for inspection.
- Does this tool verify the JWT signature?
No. This decoder only parses and displays the token structure. It does not verify whether the token is authentic or trusted.
- Can it show expiration timestamps?
Yes. If claims such as exp, iat, or nbf are present, the tool shows their raw values and readable UTC timestamps.
- Why should I not paste sensitive production tokens?
The tool runs locally in your browser, but access tokens may contain sensitive claims. Avoid sharing or saving real production tokens unless you understand the risk.
- Is my token sent anywhere?
No. Decoding runs locally in your browser and the token is not sent to a server.