The JWT Decoder reads the contents of a JSON Web Token so you can see exactly what’s inside it. Paste a token and it shows the decoded header and payload as formatted JSON, plus the issued-at and expiry times and whether the token has expired.
Decoding happens entirely in your browser — your token is never sent to a server. Note that a JWT is only base64-encoded, not encrypted, so anyone can read its contents; the signature (which this tool does not verify) is what proves it hasn’t been tampered with.
How to decode a JWT
- Paste your JWT into the box.
- Read the decoded header and payload shown as JSON.
- Check the issued-at and expiry times, and whether it’s expired.
- Remember the signature is not verified — that requires the secret or public key.
What is a JWT?
A JSON Web Token has three parts separated by dots: a header, a payload, and a signature. The header and payload are just base64url-encoded JSON, so they can be read by anyone — which is why you should never put secrets in a JWT payload.
The signature is created with a secret or private key and lets a server confirm the token is genuine and unmodified. Decoding (reading the contents) is different from verifying (checking the signature); this tool decodes.
Reading the claims
- “iat” is the issued-at time; “exp” is the expiry time (both Unix timestamps).
- “sub” usually identifies the subject (often a user ID).
- The tool flags whether the token is expired based on “exp”.
- Never paste production secrets — but decoding a token itself is safe here since it stays in your browser.
Frequently Asked Questions
Does this verify the JWT signature?
No. It decodes the header and payload so you can read them. Verifying the signature requires the secret (HS256) or public key (RS256), which isn’t needed just to view the contents.
Is it safe to paste my token here?
The decoding happens entirely in your browser and nothing is uploaded. Still, avoid sharing long-lived production tokens anywhere as a general habit.
Why can anyone read my JWT?
Because the header and payload are only base64-encoded, not encrypted. That’s by design — the signature, not secrecy, is what protects a JWT from tampering.
How do I know if a token is expired?
The tool reads the “exp” claim and shows whether the current time is past it, marking the token as expired or valid.