JWT Decoder
Decode and analyze JWT tokens
JWT Decoder: Inspect JSON Web Tokens Safely
JWT (JSON Web Token) is the standard for stateless authentication in modern APIs. It consists of three parts: header, payload, and signature — all encoded in Base64URL and separated by dots.
Our decoder breaks down each part of the token and shows you the readable JSON, including standard claims (iss, sub, aud, exp, iat) and any custom claims. Everything runs in your browser — the token never leaves your device.
IMPORTANT: this tool decodes but does not verify the signature. To verify authenticity you need the shared secret (HS256) or the public key (RS256/ES256). Never share JWTs from production in online tools.
How does it work?
- 1Paste the JWT
Copy the complete token (three Base64URL parts separated by dots) into the input field.
- 2Review the decoded content
See the header (algorithm) and payload (claims) as formatted JSON.
- 3Verify claims
Check expiration (exp), issuer (iss), subject (sub), and any custom claims you need.
Frequently Asked Questions
No. Even though our tool runs locally, best practice is to never expose JWTs from real environments. Use tokens from staging/development or generate test JWTs.
The 'exp' claim contains a Unix timestamp (seconds since 1970). Our decoder automatically shows if it's expired by comparing with the current time.
Not yet in this tool. To verify HS256 you need the shared secret; for RS256/ES256 you need the public key. Use libraries like jsonwebtoken (Node.js) or PyJWT (Python) in your backend.