🔐 JWT Decoder
Last updated:
Decode JWT tokens — view header, payload, and expiration. No data sent anywhere.
Paste a JWT token to decode its header and payload instantly in your browser. The tool splits the three-part token, base64url-decodes each segment, and displays algorithm, token type, claims, and expiration status. It flags whether the token is currently valid or expired based on the exp claim. Signature verification is not performed — that requires a secret key.
📋 When to Use the JWT Decoder
You're troubleshooting an auth flow and need to see what claims are inside a token — paste the JWT, inspect the header, payload, and signature without touching jwt.io or any third-party service. Tokens are decoded locally with JavaScript — a JWT you paste here is never sent to any server, which matters when it carries real credentials.
⚙️ How the JWT Decoder Works
The JWT Decoder processes your input using conversion algorithms that run entirely in your browser. When you paste or upload content and select the output format, JavaScript parses the input, transforms it using format-specific logic (encoding, decoding, parsing, serializing), and produces the converted output. For file conversions, all processing uses browser-native APIs and JavaScript libraries loaded from CDN — your files are never uploaded to any server. The entire pipeline from input to output stays on your device.
How to Use the JWT Decoder
- Paste your JWT token — copy the full JWT string (three base64url-encoded segments separated by dots) into the text area.
- View decoded results — the header (algorithm and token type) and payload (claims like sub, iat, exp) are decoded and displayed instantly.
- Check expiration — the tool automatically parses the "exp" claim and tells you whether the token is still valid, expired, or missing an expiration.
- Inspect all claims — scroll through the full JSON payload to see user ID, issuer, audience, issued-at time, and any custom claims your auth system includes.
Frequently Asked Questions
Is it safe to paste my JWT here?
Yes. Decoding happens entirely in your browser — the token never leaves your device. However, never share decoded JWTs publicly; the payload may contain sensitive user information like email addresses or user IDs.
Does the decoder verify the signature?
No. This tool decodes the base64url-encoded header and payload for inspection only. Signature verification requires the secret key or public key, which this client-side tool doesn't have access to. Use your backend or a JWT library for verification.
What does "exp" mean in the payload?
"exp" is the expiration time claim — a Unix timestamp after which the token is no longer valid. The decoder converts this to a human-readable date and shows whether the token is currently valid or expired.
What if my JWT doesn't have three parts?
A valid JWT always has three base64url-encoded segments separated by dots: header.payload.signature. If yours has fewer or more parts, it may be a different token format (like an opaque token) or may be malformed.
Home › Developer & Data › JWT Decoder