JWT Decoder: Decode & Inspect JSON Web Tokens Online

Decode JSON Web Token (JWT) headers and payloads directly in your browser. Inspect expiration timestamps without verifying or saving signatures.

Encoded JWT Token (Header . Payload . Signature)

Signature Not Verified: This client-side tool only decodes the unencrypted Header and Payload claims. Never trust unverified JWT payloads on production servers without cryptographic signature verification.

Token Expiration: 2030-09-21T16:37:02.000ZACTIVE

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload Claims

{
  "sub": "1234567890",
  "name": "Alice Format",
  "iat": 1516239022,
  "exp": 1916239022
}

How to Use JWT Decoder

Paste any JSON Web Token (JWT) into the input field.
Inspect the decoded Header and Claims Payload formatted as readable JSON.
Review the security badges and disclaimer notices below.

Practical Examples

Decoding an Auth Token

Inspects subject and expiration dates without uploading tokens.

Input:

eyJhbGciOiJIUzI1Ni...

Output:

Payload: { sub: "12345", name: "Alice" }

Common Mistakes & Troubleshooting

Assuming decoding verifies the token signature: Decoding a JWT only parses the Base64URL string; it does NOT verify the cryptographic signature without the server secret.

Frequently Asked Questions

Does this tool verify the JWT signature?

NO. This tool decodes the public payload and header only. Token signature verification requires the secret HMAC key or public RSA key and must be performed on your authentication server.