JWT Decoder
Decode and inspect JSON Web Token header, payload, and claims
Paste JWT Token
Frequently Asked Questions
How do I decode a JWT token to see its payload?
Paste the full JWT (the three-part dot-separated string) into the input field and click Decode Token. The tool splits it at the dots, Base64URL-decodes the header and payload segments, and renders each claim in a structured table. Standard claims such as exp (expiration), iat (issued at), and sub (subject) are labeled and converted to readable dates.
Does decoding a JWT verify its signature?
No — decoding and verifying are two distinct operations. Decoding reads the header and payload without checking the cryptographic signature. Signature verification requires the secret key or public key used to sign the token and must be done server-side. A decoded JWT that looks valid can still be forged; always verify the signature in your backend before trusting its claims.
Is it safe to paste a production JWT into this decoder?
The decoder runs entirely in your browser; the token is never sent to any server. However, as a best practice, avoid pasting live tokens that grant sensitive access. If you need to debug a production token, use a test copy or ensure the token has a very short expiration window.
How can I tell if a JWT is expired using this tool?
After decoding, look for the exp claim in the Payload section. The tool converts the Unix timestamp to a human-readable date and shows an Expired or Valid badge based on the current time. If the current time is past the exp value, the token is expired and will be rejected by any properly implemented server.
What JWT algorithms does this decoder support?
The decoder reads the alg field from the header and displays it, but it does not perform algorithm-specific signature validation. It works with tokens signed using any algorithm (HS256, RS256, ES256, etc.) because decoding only involves Base64URL decoding, which is algorithm-agnostic. What it cannot do is verify whether the signature matches for any algorithm.