JWT Decoder
Paste a JSON Web Token to read its header and claims. Decoding happens in your browser, and the signature is never checked — this shows what a token says, not whether it is genuine.
Header
—
Payload
—
Signature
—
| Claim | Value | Reads as |
|---|
Remember: anyone can write a token with any claims in it. Only your server's signature check can tell you whether this token is real or expired in a way that matters.
About
A JSON Web Token is three base64url chunks: a header, a payload of claims and a signature. This tool decodes the first two so you can read what a token actually says, including when it expires, without sending it anywhere. The signature is deliberately not treated as verified.
How to use
- Paste the token into the box.
- Decode it to see the header, the claims and the expiry time.
- Check the issuer and audience claims against what you expect.
Frequently asked questions
Can this tell me if a token is valid?
It can tell you whether it has expired and what it claims, but it does not verify the signature, because that needs the secret or public key. Treat the contents as informative rather than trusted.
Why is the payload readable?
JWT payloads are only encoded, not encrypted. Anyone holding the token can read the claims, so nothing secret belongs in one.
What is the exp claim?
An expiry time in Unix seconds. The tool converts it to a readable date and shows how long is left, which is the quickest way to spot a clock skew problem.