JWT decoder
Decode and inspect JSON Web Tokens (JWT) with detailed claim analysis
Token structure
00
Algorithm
—
Claims
0
Token status
—
Paste your JWT token here...
01
What is a JWT?
A JSON Web Token, or JWT, is a compact string that carries claims, such as who a user is and when access expires. It has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON encoded as URL-safe Base64, so anyone can read them. The signature lets a server confirm that the token has not been changed.
This decoder splits the token, shows the header and payload as formatted JSON, and turns the exp, iat and nbf claims into readable dates with a live expiry status. It decodes only and does not verify the signature. The token is decoded in your browser and never uploaded, so you can inspect production tokens without sending them to a third party.
02
How to decode a JWT
- Paste the token into the input, or click Load sample to try one.
- Read the header for the signing algorithm and token type.
- Read the payload for the claims, with dates shown in your local time.
- Check the token status to see whether it is active or expired.
- Copy the header or payload as JSON if you need it elsewhere.
03
JWT decoder FAQ
- What are the header, payload and signature of a JWT?
- The header names the signing algorithm, such as HS256 or RS256, and the token type. The payload holds the claims: registered ones such as sub, iss, aud and exp, plus any custom data. The signature is computed from the header and payload with a secret or a private key, so any change to either part invalidates it.
- Is it safe to paste a JWT here?
- The token is decoded in this browser tab and is never sent to a server, logged or stored, so pasting a production token here does not expose it. Still treat tokens like passwords: anyone who holds a valid token can use it until it expires. Clear the input when you are done, and avoid sharing screenshots of the payload.
- What do exp, iat and nbf mean?
- They are Unix timestamps in seconds. exp is the expiry time, after which the token must be rejected. iat is when the token was issued, and nbf is the time before which it must not be accepted. The decoder shows each one as a date in your local time. To convert other timestamps, use the Unix timestamp converter.
- Does this tool verify the JWT signature?
- No. It decodes the header and payload but does not check the signature, so a decoded token is no proof that it is genuine. Verification needs the secret for HMAC algorithms, or the public key for RSA and ECDSA, and it belongs on your server, using a maintained JWT library.
04