JWT Decoder
Decode and inspect JSON Web Tokens. View header, payload, and expiration info.
Decoding does not verify the signature. This tool only decodes the token payload. It cannot confirm authenticity or that the token has not been tampered with. Never enter production tokens with sensitive data into online tools.
About JWT Decoder
JSON Web Tokens (JWTs) consist of three Base64URL-encoded parts: a header, a payload, and a signature. This tool decodes the header and payload so you can inspect their contents. The signature is displayed but not verified.
About JWT Decoder
A JSON Web Token is commonly made from a Base64URL-encoded header, a payload, and a signature, joined by periods. This decoder helps developers inspect the readable header and claims during debugging, including standard timestamps such as exp and iat when present.
Decoding is not signature verification. Anyone can read an unsigned or modified payload, so the decoded claims must not be trusted until a backend verifies the signature and relevant issuer, audience, and expiry rules. Use test tokens and keep production credentials private.
How to use this tool
Paste a three-part JWT and select Decode. Review the header, payload, and signature text separately; the displayed claims are informational only.
Frequently asked questions
Does decoding verify the JWT signature?
No. This tool only decodes the token components. It does not have a signing key and cannot establish authenticity or integrity.
Why does a token contain readable information?
JWT compact serialization often uses Base64URL encoding, which is an encoding rather than encryption. Do not put confidential data in a token unless an appropriate encryption scheme is used.
What does an exp claim mean?
The exp claim is a Unix time in seconds after which a token should no longer be accepted. A server must enforce expiration and validate other claims as appropriate.
Related Tools
JSON Formatter
Format, validate, and minify JSON data with syntax highlighting and error detection.
UUID Generator
Generate cryptographically secure UUID v4 values. Single or bulk generation.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 back to plain text. Supports UTF-8.