JWT Decoder
Inspect a JWT header, payload and time-based claims without sending the token anywhere.
Header
Payload
Claim inspection
JWT decoding runs entirely in your browser. This tool does not verify the signature or prove that a token is authentic.
More Developer Tools
How to use JWT Decoder
- 1Paste a JSON Web Token into the input.
- 2Review the decoded header, payload and common time-based claims.
- 3Check the expiry status and issued-at time when those claims exist.
- 4Verify the token signature in your application or trusted identity system before relying on it.
Decode a JWT without confusing decoding with verification
A JWT decoder converts Base64URL segments into readable JSON so developers can inspect claims while debugging authentication and API integrations.
Decoding alone provides no trust. A modified token can still contain perfectly readable JSON. Production systems must verify the signature and validate claims such as issuer, audience, expiry and allowed algorithms.
Frequently asked questions
Does this JWT decoder verify the signature?
No. It decodes the token structure only. A readable payload does not prove authenticity. Verify the signature, issuer, audience and algorithm in a trusted application before accepting a token.
What is inside a JWT?
A common signed JWT has three Base64URL segments: a header, a payload containing claims and a signature. The payload is encoded, not encrypted.
Can I inspect an expired token?
Yes. The decoder shows the payload and identifies an exp claim as valid or expired relative to your device clock.
Is the token uploaded?
No. Decoding happens inside your browser. Even so, avoid sharing production tokens or leaving sensitive values visible on a shared device.
Why can anyone read a JWT payload?
Base64URL encoding is designed for transport, not secrecy. Never place passwords or confidential data in an ordinary signed JWT payload.