JWT Decoder.
Paste any JWT to see its decoded header, payload, expiry, and signature.
Paste any JWT token above to decode it.
Read what is inside a JSON Web Token.
A JWT is three Base64url segments joined by dots: a header that names the signing algorithm, a payload of claims, and a signature. Paste a token here and the header and payload are decoded and laid out as readable JSON, with the expiry and issued-at timestamps turned into human dates so you can tell at a glance whether a token is still valid.
Decoding runs entirely in the browser and the token is never transmitted, which matters because a token pasted into a random website is a credential leak. Use it to debug a 401 that should not be happening, confirm which scopes or roles a token carries, or check that your auth server is setting the claims you think it is.
Standard JWT claim reference.
The registered claim names defined in the JWT specification (RFC 7519).
| Claim | Section | Meaning |
|---|---|---|
| alg | Header | Algorithm used to sign the token (e.g. HS256, RS256, ES256) |
| typ | Header | Token type — always "JWT" for JSON Web Tokens |
| sub | Payload | Subject — identifies the principal (usually a user ID) |
| iss | Payload | Issuer — identifies the party that issued the token |
| aud | Payload | Audience — the recipient(s) the token is intended for |
| exp | Payload | Expiration time — Unix timestamp after which the token is invalid |
| iat | Payload | Issued At — Unix timestamp of when the token was created |
| nbf | Payload | Not Before — Unix timestamp before which the token must not be accepted |
| jti | Payload | JWT ID — unique identifier to prevent token replay |
What You Get
Inspect a token's real contents — header, claims, and expiry — without pasting it into someone else's server.
Header And Payload
Both segments decoded and pretty-printed as readable JSON.
Expiry Check
Reads exp and iat and tells you whether the token is still valid.
Claim Reference
Registered RFC 7519 claims explained alongside the decoded values.
Signature Shown
The third segment is displayed, so you can compare it by eye.
Malformed Input
Broken tokens report what is wrong instead of failing silently.
Never Uploaded
Decoding is local — production tokens never reach a third party.
Related tools.
More free browser-based utilities, connected by category and use case.
Base64 Encoder / Decoder
Encode or decode Base64 strings and files instantly. Also handles URL encoding/decoding and HTML entity encoding. Useful for auth headers, data URIs, and API payloads.
JSON Formatter & Diff
Paste raw or minified JSON to format, validate, and syntax-highlight it. Switch to diff mode to compare two JSON blobs side by side and see exactly what changed.
API Mock Builder
Define a JSON schema using a visual builder or raw JSON and generate a realistic mock API response. Set status codes, headers, and response delay. Copy as fetch snippet or curl command.
FAQ
JWT Decoder FAQ.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It encodes claims (statements about an entity) as a JSON object that is signed — ensuring it hasn't been tampered with. JWTs are widely used for authentication and information exchange in web applications and APIs.
What are the three parts of a JWT?
A JWT has three Base64URL-encoded parts separated by dots: 1) Header — contains the token type and signing algorithm. 2) Payload — contains the claims (user data, expiry, etc.). 3) Signature — the HMAC or RSA signature that verifies the token's integrity.
Can you verify a JWT with this tool?
No. Verification requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA). This tool only decodes the Base64URL-encoded parts to make them readable. Never share your signing secret with any online tool.
Is it safe to paste my JWT here?
This tool runs entirely in your browser — no data is sent to any server, logged, or stored. That said, JWTs can contain sensitive user information. Use test/development tokens for online tools and keep production tokens in secure environments.
What does 'exp' mean in a JWT payload?
exp is the expiration claim — a Unix timestamp (seconds since January 1, 1970 UTC) after which the token should be considered invalid. This tool converts the raw timestamp to a human-readable date and marks the token as expired if the current time is past the expiry.
What is the difference between HS256 and RS256?
HS256 (HMAC-SHA256) uses a single shared secret for both signing and verification — suitable for internal services where you control both sides. RS256 (RSA-SHA256) uses a private key to sign and a public key to verify — better for distributed systems where the verifier shouldn't have the signing key.