No upload, 100% local, no account

JWT Decoder

Paste a JWT to see its header, payload and expiry. No token is sent anywhere. Signature is NOT verified, use only for inspection.

How JWT Decoder works

JWT Decoder splits a JSON Web Token into its three parts, header, payload, and signature, and displays the header and payload as formatted JSON. The decoding is done locally in the browser by base64url-decoding each part: your token is never sent to any server. The tool does not perform signature verification; it only shows you what is inside the token's claims.

This distinction matters for security: seeing a decoded JWT tells you what claims it contains (user ID, expiry, roles, scopes) but does not confirm that the token was issued by a legitimate authority or has not been tampered with. Signature verification requires the issuer's public key or shared secret, which you should never paste into a public tool. Use this decoder for inspection and debugging only.

Written by Bastien Sulyan

How to use JWT Decoder, step by step

  1. Paste the full JWT string (three dot-separated base64url segments) into the input field.
  2. The header and payload sections appear instantly as formatted JSON.
  3. Check the 'exp' field in the payload to see the expiry timestamp (Unix epoch seconds).
  4. The signature segment is displayed as-is; this tool does not verify it.

Common use cases

  • A developer debugging an authentication issue needs to read the claims inside a JWT to confirm that the correct scopes and roles are present.
  • A QA engineer checks the 'exp' field of an access token to verify that expiry is set to the expected duration.
  • A security reviewer inspects a JWT from a third-party service to understand what user data it encodes before accepting it.
  • A backend engineer troubleshoots a 401 error by checking whether the token's 'aud' (audience) claim matches the expected API identifier.

Frequently asked questions

Does this tool verify the JWT signature?

No. The tool only base64url-decodes the header and payload segments to display their contents as JSON. Signature verification requires the issuer's secret key or public key, which you should not paste here. A decoded payload that looks valid can still have an invalid signature; always verify the signature server-side using a trusted JWT library.

Is it safe to paste a JWT into an online decoder?

It is safe with this decoder specifically, because the decoding is three calls to atob (or TextDecoder on the raw bytes) running entirely in the browser's JavaScript engine: nothing you paste here leaves your browser tab. That is not true of every online JWT tool; some send the pasted string to a server for processing, which is a real risk if the token carries session or user data. Check the network tab of your browser's DevTools to confirm no request fires when you paste a token, on this tool or any other.

What is the difference between the header, payload, and signature segments?

A JWT has three base64url-encoded segments separated by dots. The header identifies the algorithm used to sign the token (for example, HS256 or RS256). The payload contains the claims: facts about the subject and additional metadata (expiry, issuer, audience, custom claims). The signature is a cryptographic value computed from the header and payload using the issuer's key; it is what allows the recipient to verify the token was not altered.

What does 'exp' mean in the payload?

The 'exp' claim is the expiration time of the token, expressed as a Unix timestamp (integer seconds since 1 January 1970 UTC). If the current time is greater than 'exp', the token is expired and should be rejected by any server validating it. This tool shows the raw numeric value; you can convert it using the timestamp tool on this site. The expired or valid badge compares that number with the clock on your own device, so a machine whose time is wrong will judge the token wrong too. It is an indication, never a substitute for the server that actually validates the signature.

Can I decode an opaque or reference token with this tool?

No. Opaque tokens (sometimes called reference tokens) are random strings that carry no user data themselves; they must be sent to the issuer's introspection endpoint to retrieve associated claims. This tool only works with self-contained JWTs in the standard three-part format.