JWT Decoder
Decode JWT Token Header and Payload without a secret key.
How to Use
- Paste your JWT Token into the input box (format: xxxxx.yyyyy.zzzzz).
- Click Decode to view the Header, Payload, and Signature sections.
- The tool automatically detects the exp field and shows whether the token has expired.
- Click the Copy button in each section header to copy the decoded result.
About JWT Decoder
JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information as a JSON object. A JWT consists of three Base64URL-encoded parts separated by dots: the Header (algorithm and token type), the Payload (claims such as user ID and expiry), and the Signature (used to verify authenticity). JWTs are commonly used for authentication and authorization in web applications and APIs. This decoder lets you inspect the Header and Payload of any JWT without verifying the signature. Never paste production JWTs with sensitive data into online tools -- use this tool only with test tokens.
Use Cases
Debug Authentication Issues
Decode access tokens to verify claims (sub, exp, iss) when troubleshooting login failures or 401 errors.
Check Token Expiration
Quickly see when a JWT expires without writing code — useful during API development and testing.
Verify Token Payload
Inspect custom claims (roles, permissions, tenant ID) to confirm the token carries expected data.
API Integration Testing
Decode tokens from OAuth providers to understand their claim structure before writing integration code.
Examples
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}The payload section (between the two dots) is Base64URL-decoded to reveal the JSON claims.
Common Pitfalls & Edge Cases
- ⚠JWTs are signed but NOT encrypted by default. Anyone can decode the payload — never store secrets in JWTs.
- ⚠This tool decodes only. It cannot verify signatures without the secret/private key.
- ⚠'exp' is a Unix timestamp in seconds, not milliseconds. Multiply by 1000 for JavaScript Date.
- ⚠Expired tokens may still decode successfully — always check 'exp' claim in your application.
🔒 Data Privacy
JWT decoding is pure Base64URL parsing done locally in your browser. Your tokens are never sent to any server.
Standards & References
Frequently Asked Questions
Comments (0)
Leave a comment