JWT Decoder
Decode JWT tokens — header and payload.
A JWT has three base64url parts: header, payload, signature. The first two are just encoded JSON — readable by anyone.
⚠️ Decode only — signatures are not verified. Never paste production secrets into any website.
How to use
- Paste the full JWT (header.payload.signature).
- Header and payload decode live as you type.
- Expiry time is shown when present.
About this tool
This tool decodes them so you can inspect claims like expiry, issuer and scopes while debugging auth.
Decoding is local; and note the signature is NOT verified here — this is an inspector, not a validator.
How it works
A JWT has three Base64URL-encoded parts separated by dots: header.payload.signature. The header names the algorithm ({"alg":"HS256","typ":"JWT"}); the payload carries claims such as sub (subject), exp (expiry), and iat (issued at); the signature is HMAC-SHA256 over the first two parts, computed with a secret key.
Decoding only reveals the payload — it verifies nothing. The payload is encoded, not encrypted: anyone holding the token can read it. Never put passwords or other secrets inside a JWT.
Verification means re-computing the signature with the secret and comparing. A match proves the token is untampered and was signed by someone holding the secret. This tool decodes; your backend must still verify.
Worked examples
Why did my session expire?: Paste the access token and read the exp claim — say it shows 1728000000, a time already past. The token expired; request a refresh instead of debugging your login code.
Confirming user roles: Decode the token your API returned and check the payload for "role": "admin" before assuming the frontend hid an admin button for some other reason.
Quick reference
| Claim | Full name | Meaning |
|---|---|---|
| iss | Issuer | Who created the token |
| sub | Subject | Who the token is about |
| exp | Expiration | Unix time after which it is invalid |
| iat | Issued at | Unix time of creation |
| nbf | Not before | Unix time before which it is invalid |
Frequently asked questions
Is it safe to paste a token here?
Decoding happens entirely in your browser, but as a rule avoid pasting live production secrets into any website.
Does it verify the signature?
No — this is decode-only. Verification needs the secret key and belongs in your backend.
What do "exp" and "iat" mean?
Expiry and issued-at times, in Unix seconds.
More free tools
UUID Generator
Generate random v4 UUIDs in bulk.
Base64 Encode / Decode
Encode text to Base64 or decode it back.
Color Converter (HEX ↔ RGB)
Convert HEX to RGB and back, with live preview.
JSON Formatter & Validator
Format, minify and validate JSON in one click.
What Is My IP
See your public IP address instantly. No sign-up, nothing stored.
URL Encoder / Decoder
Encode or decode URLs and query strings.