JWT Decoder
Paste a JWT to see its header and payload as readable JSON, without needing the signing secret or a running application to log in to.
Overview
A JWT's header and payload are just Base64-encoded JSON, not encrypted — anyone with the token can already read the claims inside it, which is exactly what this tool does for you. That makes it useful for debugging auth flows, checking token expiry, or confirming what claims an issuer actually included, without needing to verify the signature or have access to the signing key.
Examples
Sample token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
How It Works
- Paste a JWT into the input box.
- The decoded header and payload appear immediately as formatted JSON.
- Check the "exp" and "iat" claims to inspect issue and expiry times, if present.
FAQ
No. The token is decoded entirely in your browser — it never leaves your device, which matters since a JWT can contain sensitive claims.
No. This tool only decodes the header and payload for inspection. Verifying a signature requires the signing secret or public key, which this tool never asks for.
Since decoding happens locally and nothing is transmitted, it's safe from a network standpoint — but treat any token as sensitive and avoid sharing screenshots of the decoded output.
JWT timestamp claims are Unix time in seconds. Convert the number using the Timestamp Converter to see it as a readable date.