JWT Decoder
Decode and inspect JWT tokens (header, payload, signature)
JWT Decoder splits a JSON Web Token into its three parts, decodes the header and payload from Base64 into readable JSON, and checks the token's exp claim against the current time to tell you plainly whether it's expired.
How to use JWT Decoder
- 1
Paste your JWT (the full header.payload.signature string).
- 2
The decoded header and payload appear instantly as readable JSON.
- 3
Check the expiry status, shown clearly if the token has an exp claim.
- 4
Copy any part you need for debugging.
Everything you need to know about JWTs
What's actually inside a JWT?
A JWT (JSON Web Token) has three parts separated by dots: a header, a payload, and a signature. The header and payload are just Base64-encoded JSON — readable by anyone, not encrypted — while the signature is what actually proves the token wasn't tampered with, verifiable only with the secret key that created it.
Why decoding doesn't need the secret
Since the header and payload are only encoded (not encrypted), decoding and reading them requires no secret at all — the secret is only needed to *verify* the signature is valid, which is a separate step this tool doesn't perform.
A security note
Never paste a JWT containing real, live session data from a production system into any third-party tool — decode test tokens or redact sensitive claims first, since the *contents* are fully readable by anyone who has the token string.
Related Developer Tools
JSON Formatter
Format, validate and beautify JSON with syntax highlighting
JSON Minifier
Minify and compress JSON by removing whitespace
JSON Viewer
Interactive tree view for exploring complex JSON data
XML Formatter
Format and validate XML documents
YAML Formatter
Format, lint and validate YAML files
CSV to JSON
Convert CSV files or data to JSON format
Frequently Asked Questions
Does this verify the token's signature?
No — this only decodes the header and payload, which is possible for anyone since JWTs are Base64-encoded, not encrypted. It does not check whether the signature is valid, since that requires the issuer's secret or public key, which this tool never asks for.
How is "expired" determined?
If the payload has an exp claim (a Unix timestamp), it's compared against the current time. A token with no exp claim is reported as not expired, since there's nothing to check it against.
Is it safe to paste a real token from my application here?
Treat any JWT as sensitive, since its payload is fully readable to anyone who has it. For production tokens, prefer decoding ones from a test or staging environment where possible.
Does this tool send my token to a server?
Yes — the token is sent to our servers to decode and the result is returned to you; it isn't stored.
Is this tool free to use?
Yes — completely free, with no signup and no usage limits for casual use.