JWT Decoder
Decode header and payload. Signature verification requires a key and is not performed.
Token
Header
Payload
How to Decode JWT Tokens?
- Paste your JWT token in the Token text area.
- Click Decode to extract header and payload.
- View the decoded header and payload in JSON format.
- Click Copy Header or Copy Payload to copy specific parts.
- Note: Signature verification is not performed (requires secret key).
Free JWT Decoder & Inspector
Decode any JSON Web Token (JWT) instantly and inspect its header and payload claims. JWTs are widely used for authentication and API authorization ā but their contents are Base64-encoded and not immediately human-readable. This tool decodes them in your browser so you can inspect expiry times, user claims, algorithm, and issuer without any setup.
What You Can Inspect
- Header ā Algorithm (alg) and token type (typ), e.g. HS256, RS256
- Payload ā Claims like sub (subject/user ID), exp (expiry), iat (issued at), iss (issuer), and custom application claims
- Expiry Check ā Spot expired tokens quickly by checking the exp timestamp
100% client-side decoding ā your token is never sent to any server. Note: this tool decodes but does not verify the signature.
Frequently Asked Questions
Is it safe to paste my JWT into this tool?
Yes. Decoding is done entirely in your browser using JavaScript ā the token is never sent to any server. However, avoid pasting production tokens with sensitive claims into any online tool as a general security practice.
Does this tool verify the JWT signature?
No. Signature verification requires the secret key (for HMAC) or public key (for RSA/ECDSA), which this tool does not have. It only decodes the Base64-encoded header and payload. Verification must be done server-side with the proper key.
What is the exp claim in a JWT?
The exp (expiration) claim is a Unix timestamp indicating when the token expires. Compare it to the current time to check if the token is still valid. An expired token will be rejected by APIs that validate it properly.
What JWT algorithms are commonly used?
HS256 (HMAC-SHA256) uses a shared secret and is common for internal APIs. RS256 (RSA-SHA256) uses a public/private key pair and is preferred for distributed systems where different services verify tokens. The algorithm is visible in the decoded header.
