JWT Decoder
Paste a JSON Web Token to read its header and payload without any server call. Great for debugging auth issues and checking expiry.
How to use jwt decoder
- Paste the token
Copy a JWT from your app, cookie or Authorization header and paste it in.
- Click decode
The header and payload are Base64URL-decoded and shown as formatted JSON.
- Check the claims
Review issued-at and expiry times, which are converted to readable dates.
Features
See the algorithm and all claims side by side in clean JSON.
exp and iat are translated to human dates so you can spot expired tokens.
Decoding is local; the tool never verifies against or transmits your secret key.
Frequently asked questions
Does this verify the signature?
No. It only decodes the readable header and payload. Verifying a signature needs the secret or public key and should be done server-side.
Is it safe to paste a real token?
Decoding happens entirely in your browser, but treat any live token as a credential and avoid sharing it or leaving it on shared computers.
Why can't it read my token?
A JWT must have three dot-separated Base64URL sections. If a part is missing or altered, decoding will fail.