A JSON Web Token (JWT) carries data in three parts. This decoder reveals the header and payload so you can inspect claims and expiry while debugging.
Decoding runs in your browser, so your token is never uploaded.
How to use the JWT Decoder
- Paste your JWT.
- View the decoded header and payload.
- Check claims such as expiry.
Reading a JWT safely
A JSON Web Token has three Base64 parts separated by dots: a header naming the algorithm, a payload carrying the claims, and a signature. The header and payload are only encoded, not encrypted, so anyone holding a token can read them. This decoder shows both parts instantly, which is the fastest way to check what a token actually claims: user id, roles, issuer, and the exp field that tells you when it expires.
Why decoding here is safe
Pasting production tokens into random websites is risky because a token is a live credential. This decoder runs entirely in your browser: the token is parsed locally and never transmitted, so nothing is logged on any server. Note that decoding does not verify the signature; whether the token is genuine can only be checked by the system holding the signing key.
Common uses
- Checking why an API rejects a token, usually expiry
- Inspecting claims and roles during login debugging
- Verifying what your auth provider actually puts in tokens
- Learning JWT structure with real examples
Frequently asked questions
Is the JWT decoder free?
Yes, free with no signup.
Is my token uploaded?
No. Decoding happens locally in your browser.
Does it verify the signature?
No. It decodes the readable header and payload; it does not verify the signature.
Can it show token expiry?
Yes. If the token has an expiry claim it is shown.