JWT Decoder
Decode and inspect JSON Web Tokens instantly. View header, payload, and expiration status. 100% browser-based — your tokens never leave your device.
🔒 Privacy First: All decoding happens in your browser. Your tokens never leave your device.
How to Decode a JWT
- Paste your JWT token in the input field
- Click "Decode Token"
- View the decoded header, payload, and claims
- Check the expiration status
About JWT Tokens
JWT (JSON Web Token) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims are encoded as a JSON object that is digitally signed.
A JWT consists of three parts separated by dots: Header, Payload, and Signature. The header and payload are Base64Url encoded JSON objects.
Security Note: While this tool can decode JWTs, it cannot verify signatures. Never share your secret keys with any third-party tool. Treat JWTs like passwords — they often contain sensitive information.
Frequently Asked Questions
What is a JWT token?
JWT (JSON Web Token) is a compact, URL-safe way to represent claims between two parties. It's commonly used for authentication and information exchange in web applications.
Is it safe to decode JWT tokens online?
With our tool, yes! All decoding happens in your browser. Your tokens never leave your device. However, you should never share JWT tokens publicly as they may contain sensitive information.
What information is in a JWT?
A JWT has three parts: Header (algorithm and token type), Payload (claims like user ID, expiration, etc.), and Signature (for verification). Our decoder shows the header and payload.
Can this tool verify JWT signatures?
This tool decodes and displays JWT contents but doesn't verify signatures. Signature verification requires the secret key, which should never be shared with a third-party tool.
What does the 'exp' claim mean?
The 'exp' claim is the expiration time in Unix timestamp format. Our decoder shows this as a human-readable date and indicates if the token has expired.
Why is my token not decoding?
Make sure you're pasting a complete JWT token. It should have three parts separated by dots (xxxxx.yyyyy.zzzzz). The header and payload must be valid Base64-encoded JSON.