About the JWT Decoder
A JSON Web Token (JWT) is a compact, three-part string used to represent claims securely between two parties — most commonly for authentication and authorization in web APIs. It consists of a header, a payload, and a signature, each Base64URL-encoded and separated by dots.
This tool decodes a JWT's header and payload so you can inspect exactly what claims, expiry, and algorithm are embedded inside it, without needing the secret key that was used to sign it.
How it works
- Paste a full JWT (the three dot-separated segments) into the input box.
- The header and payload are decoded and pretty-printed automatically as you type.
- Check the token metadata panel to quickly see the signing algorithm and whether the token has expired.
Common use cases
- Debugging login issues: Inspecting a JWT returned from an auth provider to confirm which claims (like `sub`, `roles`, or `exp`) actually made it into the token.
- Checking token expiry: Quickly verifying whether an access token has already expired without writing a script to parse it.
- Verifying integration configuration: Confirming that a token's `alg` and `iss` (issuer) claims match what your backend expects before debugging further.
Frequently asked questions
Does decoding a JWT verify that it's valid or untampered?
No. Decoding only reads the Base64URL-encoded header and payload — it does not check the signature. A JWT can be decoded and read by anyone without the secret key; only signature verification (which requires the secret or public key) confirms the token hasn't been tampered with.
Is it safe to paste a real production token here?
The decoding happens entirely in your browser and the token is never sent anywhere, but as a general habit, avoid pasting live production credentials into any web tool — use a test or expired token where possible.
Why does the tool say my token is expired?
The `exp` claim in the payload is a Unix timestamp; if it's earlier than the current time, most systems will reject the token as expired, and this tool flags that for convenience.
What if I get a 'must contain 3 segments' error?
A JWT always has exactly three dot-separated parts (header.payload.signature). If your string has more or fewer, it's either truncated, not a JWT at all, or has extra whitespace/newlines — check the raw value again.
This tool runs entirely in your browser — nothing you enter is sent to a server. Read more in the Privacy Policy, or browse the full list of tools.