JWT Decoder
Read a JWT’s header and payload. Decoding only: it does not verify signatures. Everything runs in your browser, so your input isn’t uploaded.
Loading tool…
How to use the JWT Decoder
- Paste a token. A leading “Bearer ” is fine.
- Read the header, the payload and the claims such as when it expires.
- Remember that this only reads the token: it cannot tell you whether the token is genuine.
Example
A token made up for this example. Its two readable parts decode to JSON. The signature is a placeholder, and this tool never checks it.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwMDM2MDB9.c2lnbmF0dXJlLW5vdC12ZXJpZmllZA
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "1234567890",
"name": "Jane Doe",
"iat": 1700000000,
"exp": 1700003600
}About this tool
A JSON Web Token has three parts separated by dots: a header, a payload of claims, and a signature. The first two are just encoded text, so anyone can read them. This tool decodes them and explains the time-based claims.
Good to know
- This tool does not verify the signature. A token that decodes correctly can still be forged or tampered with. Only a server holding the right key can verify it.
- Never trust the contents of a token you haven’t verified when making security decisions.
- Nothing is sent anywhere, but treat live tokens like passwords: prefer expired or test tokens when you can.
Related tools
- URL Encoder & Decoder – Percent-encode or decode text for use in URLs.
- HTML Entity Encoder & Decoder – Escape special characters as HTML entities, or turn entities back into text.
- Base64 Encoder & Decoder – Encode text to Base64 or decode it back, including emoji and non-English text.
- Unix Timestamp Converter – Convert Unix seconds or milliseconds to dates, and dates back to timestamps.
- HTTP Status Code Reference – Look up what any HTTP status code means.