JWT Decoder
Runs in your browser — your data never leaves your device.
Decode a JSON Web Token and inspect its header, payload and expiry.
The signature is not verified: this tool only reads the token.
What is JWT Decoder?
A JSON Web Token (JWT) is a compact token with three Base64URL parts: header, payload and signature. A decoder turns the first two back into readable JSON so you can see the claims, such as who the user is and when the token expires.
Useful for
- Checking which claims an authentication token carries.
- Finding out why a token is rejected as expired.
- Debugging OAuth and OpenID Connect integrations.
How to use
- Paste the token, with or without the Bearer prefix.
- Read the decoded header and payload.
- Check the issued-at and expiration dates, shown in your local time.
Examples
Decode a token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJuYW1lIjoiQWRhIiwiZXhwIjoxNzAwMDAwMDAwfQ.signature{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "123",
"name": "Ada",
"exp": 1700000000
}Frequently asked questions
Does decoding verify the signature?
No. Decoding only reads the token. Verifying the signature requires the secret or the public key, and the payload should not be trusted until it is verified.
Is it safe to paste a real token here?
Decoding runs only in your browser and the token is never uploaded. Even so, avoid sharing production tokens in screenshots or chats.
Why does it say my token expired?
The exp claim holds the expiration as seconds since 1970. The decoder converts it to your local time and compares it with your device clock, so a wrong clock can also make a valid token look expired.