JWT Decoder
Inspect a JSON Web Token's header and payload (signature not verified).
Decodes for inspection only — does not verify the signature · processed in your browser
About this tool
The JWT Decoder lets you quickly inspect what is inside a JSON Web Token. Paste the token and you instantly see both the header and the payload as readable JSON. It is built for developers working with authentication systems who need to check exactly which claims a token carries.
A JWT has three dot-separated parts: header, payload, and signature. Both the header and payload are Base64URL-encoded rather than encrypted, which means they can be read as soon as they are decoded. This decode jwt tool does that for you automatically, surfacing details like the signing algorithm, the subject (sub), the issued-at time (iat), and the expiry (exp).
One important point to understand: this tool only decodes and displays — it does not verify the signature. Confirming that a token is authentic and untampered requires checking it against a secret or public key on the server, which is outside the scope of simply viewing its contents.
- Read the header to learn the algorithm, such as HS256 or RS256
- Read the payload to inspect standard and custom claims
- Check exp to see whether the token has expired
Because a json web token payload is trivial to read, you should never store sensitive data inside it. This tool runs entirely in your browser, your token is never sent anywhere, it is free to use, and no account is required.
How to use
- 1Paste your JWT (JSON Web Token), including all three dot-separated parts, into the input
- 2The header is decoded and shown, revealing the algorithm and token type
- 3View the payload to inspect claims such as sub, exp, and iat
- 4Read the decoded values as cleanly formatted JSON
- 5Check the expiry (exp) claim to see whether the token is still valid
Frequently asked questions
- Does this tool verify the JWT signature?
- No. This tool only decodes and displays the header and payload. It does not verify the signature, which requires the secret or public key on the server side.
- Is it safe to paste a JWT here?
- Yes, because decoding happens entirely in your browser and the token is never sent to any server. Even so, always be careful with live production tokens.
- Is the data inside a JWT encrypted?
- Usually the payload is only Base64URL-encoded, not encrypted. Anyone holding the token can read the payload, so never store secrets inside it.
- The exp claim decodes to a number — what does it mean?
- The exp claim is a Unix timestamp marking the token's expiry. If the current time is past that value, the token is considered expired.
- Is it free, and do I need to sign up?
- It is completely free with no signup, and none of your data is stored or transmitted.