JWT Decoder
Paste a JSON Web Token to read its header, payload and expiry time.
Header
Enter a JWT to view the header data
Payload
Enter a JWT to view the payload data
Signature
Enter a JWT to view the signature
How to use it
- Paste the token into the box. Remove any Bearer prefix first.
- Press Decode JWT.
- Read the header, payload and signature panels. An expiry line appears when the payload has an exp claim.
Decoding only reverses the Base64URL encoding. The payload of a JWT is readable by anyone who holds the token, so never put secrets in it.
Frequently Asked Questions
What is inside a JWT?
Three Base64URL parts separated by dots: a header with the algorithm and token type, a payload with claims such as sub, iat and exp, and a signature.
Does the tool verify the signature?
No. It decodes the header and payload and shows the signature text as it appears in the token. Verifying a signature needs the secret or public key, and this tool never asks for one.
How does it know if a token has expired?
If the payload has an exp claim, the tool compares it with the current time on your device and shows the expiry date in your local time zone. Tokens without exp show no expiry line.
Is it safe to paste a real token?
The decoding runs in your browser and the token is not sent to a server. Even so, treat live tokens as passwords: anyone who has one can use it until it expires, so prefer test tokens or revoke the token afterwards.
Why do I get an Invalid JWT format error?
The token must have exactly three parts separated by dots, and the first two must decode to JSON. Check for missing characters, extra spaces or a leading Bearer prefix.
More tools
UUID Generator
Generate random UUIDs in bulk.
Hash Generator
Create SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files in your browser.
URL Encoder / Decoder
Percent-encode and decode URLs and query strings.
Color Converter
Convert colors between HEX, RGB, HSL and more.
QR Code Generator
Create QR codes for links and text and download them.
Password Generator
Generate strong random passwords in your browser.
Published