JWT decoder
Decode a JSON Web Token's header and payload and inspect its time claims. No verification.
How to use
Paste a JSON Web Token (JWT) and the tool splits it into its three parts and decodes the header and payload into readable JSON, so you can see exactly what claims it carries — issuer, subject, expiry and any custom fields.
It's the quickest way to inspect a token while debugging authentication, without writing code. The decoding happens entirely in your browser, so the token is never sent to a server — important, since tokens are sensitive credentials.
Remember that decoding is not the same as verifying: this shows you what's inside the token but doesn't check the signature, which requires the secret or public key.
Examples
Decode a token from a request to confirm the user ID and scopes it contains.
Read the exp claim to see whether a token has expired or when it will.
View custom claims an API added so you can match them to your app's logic.
Frequently asked questions
Does this verify the token's signature?
No. It decodes and displays the header and payload only. Verifying the signature requires the signing secret or public key, which this tool doesn't handle.
Is it safe to paste my token here?
Yes. Decoding happens entirely in your browser — the token is never uploaded — but as always, be careful with live credentials.
Why are the parts Base64-looking?
A JWT is three Base64URL-encoded sections (header, payload, signature) separated by dots. The tool decodes the first two to readable JSON.
Can I read an expired token?
Yes. Decoding works regardless of expiry; the exp claim tells you whether it's still valid.
Related tools
Encode text to Base64 or decode Base64 back to text, with URL-safe support.
Format, validate and minify JSON with precise error locations and key sorting.
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text at once.
Compute a keyed HMAC signature (SHA-1/256/384/512) for a message using a secret key.
Percent-encode or decode text for safe use in URLs, in component or full-URI mode.