JWT Decoder
Decode JWT header and payload instantly — inspect claims, expiry and algorithm.
Free · No sign-up · Runs locally in your browser · Also available in Chinese (中文)
What is JWT Decoder?
A JSON Web Token is three Base64URL segments joined by dots: a header naming the signing algorithm, a payload carrying the claims (user ID, roles, iat, exp), and a signature. Decoding is pure Base64 — no key needed — which is why anyone holding the token can read everything inside it.
This decoder splits the token, pretty-prints the header and payload, and translates the standard claims into human terms: issued-at and expiry become real dates, with a live expired/valid indicator. Decoding happens entirely in your browser — paste production tokens freely.
How to use it
- 1Paste the full JWT (all three dot-separated parts) into the input.
- 2Read the decoded header and payload in the panels below.
- 3Check the expiry claim: the tool shows whether the token is currently valid.
- 4Copy any claim value you need for debugging or logging.
Common use cases
- Debugging auth: what claims did the server actually put in this token?
- Checking why a request returns 401 — is the token expired or missing a role?
- Inspecting token contents during development without any external decoder site.
Frequently asked questions
▸Does decoding verify the signature?
No. Decoding just reads the Base64 content; verification requires the signing key. Never trust a token's claims until the signature is verified server-side — decoding is for inspection only.
▸Is it safe to paste a real token here?
The token never leaves your browser — there is no upload. Still, treat tokens as secrets: do not paste them into shared screens, logs or issue trackers.