JWT Decoder
Read the header and payload of a JSON Web Token and inspect timestamp claims, entirely in your browser.
What does this tool do?
A JWT decoder reads the token's header and payload so you can inspect claims while debugging. Decoding does not verify the signature, issuer, audience, or authenticity.
When to use this tool
Inspect a JSON Web Token while debugging an authentication integration. The decoder displays the header, payload, and readable timestamp claims. It does not verify signatures, establish trust, or replace token validation in your application.
How to use JWT Decoder
- Paste a three-part JWT or load the demonstration token.
- Select Decode token to inspect the header and payload.
- Review standard claims and their readable dates.
A quick example
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"developer"}Common questions
Does this verify my token?
No. A decoded token can have a forged signature. Verify it in your authentication system with the correct key, issuer, audience, and allowed algorithm.
Does an unexpired exp claim mean the token is valid?
No. The timestamp is just an unverified claim. Signature verification and all applicable validation rules are still required.
Working with a large input? Text converters accept up to 1,000,000 characters. Regex test text is limited to 50,000 characters and JWTs to 100,000.