JWT Decoder
Inspect header, payload and expiry — no secret required or accepted
This decodes the token only — it does not verify the signature, which would require your signing key. Never paste a signing secret into any web page.
Enter something above to see the result.
Everything runs in your browser. Your data never leaves your device.
Related tools
How to use
A JWT is three Base64URL segments separated by dots: header, payload and signature. The first two are merely encoded, not encrypted, so anyone holding the token can read every claim inside it.
Paste the token
Include all three segments. If you copied from an Authorization header, drop the leading "Bearer " — the token itself starts at eyJ.
Read the header
The alg claim names the signing algorithm and kid identifies which key was used. An alg of "none" is a red flag and should never be accepted by a server.
Read the payload
These are the claims your application acts on — typically sub for the subject, plus roles or scopes. Registered time claims iat, exp and nbf are resolved to dates for you.
Check the expiry badge
Expiry is computed from exp against your device clock. A token showing as expired when the server accepts it usually means your system clock has drifted.
Examples
A standard access token
A typical token decodes to a header of {"alg":"HS256","typ":"JWT"} and a payload carrying sub, name, iat and exp. The exp value 1753003600 resolves to a readable date and drives the expiry badge.
Why claims are not secret
Base64URL is an encoding, not encryption. Any claim you place in a payload — email address, internal user ID, role — is readable by anyone who obtains the token. Put nothing sensitive in a JWT.
About this tool
Decode a JSON Web Token to read its header and claims, with registered time claims resolved to readable dates and expiry state shown at a glance. The tool decodes only and never verifies signatures, because verification would require your signing key and no web page should ever ask for one.