Home › Tools › JWT Decoder

JWT Decoder

Paste a JSON Web Token below to read its header and payload, see its claims in a structured view, and check whether it has expired. Runs entirely in your browser.

Last updated: 11 Nov 2026 Read time: 6 min Category: Developer Tools Standard: RFC 7519
Ad placement (top)

What is a JSON Web Token

A JSON Web Token, or JWT, is a compact way to carry claims between two systems. Each token is a string with three parts separated by dots: the header, the payload and the signature. The header describes the signing algorithm and token type. The payload contains the claims, such as the user id, the role and the expiration time. The signature proves that the header and payload were not changed in transit and that the token was issued by a party that holds the signing key.

JWTs are defined by RFC 7519 and are the default token format for OAuth 2.0, OpenID Connect and most modern API authentication flows. Because the payload is readable by anyone who sees the token, JWTs are used to transport identity but never to transport secrets.

Anatomy of a Token

Take the example token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NSIsIm5hbWUiOiJKYW5lIERvZSIsImlhdCI6MTc2MjgwMDAwMH0.sig.... The first segment decodes to {"alg":"HS256","typ":"JWT"} which tells the receiver this is a JWT signed with HMAC SHA-256. The second segment decodes to the payload JSON with the user subject, name and issued-at time. The third segment is the raw signature bytes, not JSON, which is why a decoder leaves it opaque.

Decoding is not verifying Anyone can read a JWT payload. A token is only trustworthy after the server verifies the signature against its secret or public key. This tool decodes but never verifies.

How to Use This Tool

  1. Copy a JWT from your browser cookies, an API response or an HTTP Authorization header.
  2. Paste it into the text area above and press Decode.
  3. The header, payload and signature appear in separate boxes with syntax formatting.
  4. Scroll to the claims summary for a human readable view of exp, iat, iss, aud and any custom claims.
  5. An expiration banner will tell you at a glance whether the token is still valid.

Reading the exp Claim

The exp claim is a Unix timestamp measured in seconds since 1 Jan 1970. If the current time is greater than that number, the token has expired. Many bugs in authentication systems come from comparing seconds to milliseconds by mistake. This decoder shows both the raw number and the human readable date in your local time zone so you can spot the mismatch instantly.

When JWTs Are the Right Choice

  • Stateless API auth: the server does not need a session store because the token itself carries the user identity.
  • Single sign-on: an identity provider issues one signed token that many downstream services accept.
  • Short-lived access: access tokens with 15 minute expirations are a common pattern alongside long-lived refresh tokens.

When JWTs Are Not the Right Choice

  • When you need to revoke a token before it expires, since JWTs are valid until the exp time unless you add a server-side deny list.
  • When the payload contains data that changes often, since the token is signed at issue time and cannot be edited later without reissuing.
  • When the payload must be secret. JWTs are signed but not encrypted. Use JWE if you need encryption.

Privacy

Decoding happens inside this page using plain JavaScript. The pasted token never leaves your device. The tool does not log, store or transmit the input. Even so, remember that a real production token is an active credential. If you paste one here from a live system, consider rotating it after you are done inspecting it.

Frequently Asked Questions

What is a JWT?

A compact string with three dot-separated parts: header, payload and signature. The first two are Base64URL-encoded JSON.

Does this tool verify the signature?

No. Verification needs the issuer's secret or public key. This tool reads the token but does not trust it.

What are the standard claims?

iss, sub, aud, exp, nbf, iat and jti. Applications add custom claims such as email, scope or role.

How do I check if a JWT is expired?

Compare the exp claim (seconds) with the current Unix time. This tool does that for you and shows a banner.

Is it safe to paste real tokens?

Decoding is local but any real token is a credential. Rotate it after use if the system is sensitive.

Why is the signature unreadable?

It is a cryptographic hash, not text. Only the issuer, with the matching key, can verify it.

Does this work with encrypted JWE tokens?

No. JWE encrypts the payload and needs the recipient key to decrypt. This tool handles signed JWS tokens only.