JWT Decoder — Complete Guide
A JWT (JSON Web Token) is a compact, self-contained token used to securely transmit information between parties. It consists of three base64url-encoded parts separated by dots: a header, a payload, and a signature. The header specifies the algorithm used to sign the token. The payload contains the claims — the data encoded in the token like user ID, roles, and expiry time.
This tool decodes the header and payload of any JWT so you can read the contents without needing to verify the signature. This is useful for debugging authentication issues, checking expiry times, and inspecting the claims a token contains.
Important: This tool is for inspection only. It decodes but does not verify the signature. Never trust a JWT's claims in production code without verifying the signature against the issuer's public key or secret.
What you can do with JWT Decoder
- Debugging authentication flows by inspecting token contents
- Checking JWT expiry time (exp claim) to understand why a token was rejected
- Inspecting user roles and permissions encoded in token claims
- Verifying that a token contains the expected claims during development
- Reading token metadata during API integration debugging
How to use JWT Decoder
Paste your JWT string (the full three-part token with dots) into the input field
The decoded header and payload are displayed as formatted JSON
Inspect the claims — check exp for expiry, iat for issued-at time, sub for the subject
Tips for best results
The exp claim is a Unix timestamp — use a timestamp converter if you need to read it as a human date
JWTs are only base64-encoded, not encrypted — never put sensitive data like passwords in a JWT payload unless the whole token is encrypted (JWE)
Check the iss (issuer) claim to confirm the token came from the expected authentication server
Other tools you might find useful
Frequently asked questions
Is it safe to paste a real JWT into this tool?
JWTs are often not sensitive by themselves — the payload is just base64-encoded and is not secret. However, if a JWT is used as a bearer token it should be treated like a password. For testing, use a token from a development environment rather than production.
Why does the tool show the payload but say it can't verify the signature?
Verifying a JWT signature requires the secret key or public key used to sign it. This tool only has the token, not the key. It can decode the contents but cannot confirm the token is authentic — that verification must happen in your application code.
What does 'exp' mean and why is my token being rejected?
The exp claim is a Unix timestamp representing when the token expires. If the current time is past this timestamp, the token is expired and will be rejected by the server. Check the value in a timestamp converter to see when it expired.