About the JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64Url-encoded parts separated by dots: header, payload, and signature. This free online JWT Decoder splits and decodes the header and payload so you can read the claims in plain JSON.
It is perfect for debugging authentication flows — inspect claims like subject, roles, issuer, issued-at, and expiry. Decoding happens entirely in your browser, so your tokens are never sent to a server.
How to decode a JWT
- Paste your JWT into the input box.
- The decoded header and payload appear instantly as formatted JSON.
- Review the issued-at (iat) and expiry (exp) times if present.
- Copy the header or payload with one click.
- Click Clear to decode another token.
Features
- Decodes JWT header and payload to readable JSON.
- Shows issued-at and expiry times as human-readable dates.
- Flags whether the token is active or expired.
- Handles Unicode claims correctly (UTF-8 aware).
- 100% client-side — tokens never leave your browser.
JWT Decoder FAQs
Does this tool verify the JWT signature?
No. This is a decoder, not a verifier. It reads the header and payload but does not validate the signature, which requires the secret or public key. Never trust an unverified token in production.
Is it safe to paste my token here?
Yes. Decoding happens entirely in your browser using JavaScript. Your token is never uploaded, logged, or stored. Still, avoid sharing production tokens publicly.
What are the three parts of a JWT?
A JWT has a header (algorithm and type), a payload (the claims), and a signature (used to verify integrity). They are Base64Url-encoded and joined with dots.
What do iat and exp mean?
iat is the issued-at time and exp is the expiry time, both as Unix timestamps. This tool converts them to readable dates and shows whether the token has expired.
Why does my token show as invalid?
The token must have at least a header and payload separated by dots, and both must be valid Base64Url-encoded JSON. Check for missing parts or copy errors.
