JWT Decoder

Decode and inspect JSON Web Tokens in your browser. View the header, payload claims, and expiration status without sending your token to any server.

100% client-side. Your data never leaves your browser.

Converters & Examples

Decode Expired JWT Token: Check Token Expiry

Decode a JWT with an expired exp claim. Inspect the payload to see when it expired and troubleshoot authentication issues.

 Decode a JWT Token: See Header, Payload & Claims

Decode a sample JWT to see the header, payload claims (sub, iss, exp, iat), and signature. Covers JWT structure, Base64url encoding, and security gotchas.

Related Tools

b64
Base64 Encode/Decode

Encode and decode Base64 strings online. Handles UTF-8 text, emoji, and binary data with full round-trip support. No server, no signup.

 {}
JSON Formatter + Tree Viewer

Paste JSON to pretty-print, minify, or validate it with syntax highlighting and an interactive tree view. Real time error detection with line numbers.

JWT Decoder: Inspect Tokens Instantly

Paste a JSON Web Token to decode its header and payload, check expiration status, and inspect individual claims. Everything runs in your browser. Your token is never transmitted anywhere.

How to Use

  1. Paste your JWT into the input field (it starts with eyJ)
  2. Review the header to see the signing algorithm (HS256, RS256, etc.) and token type
  3. Inspect the payload for claims like subject, issuer, expiration, and custom fields
  4. Check the expiry banner to see if the token is still valid or when it expired
  5. Copy individual sections using the Copy buttons on each panel

Understanding JWT Structure

A JWT is three Base64URL-encoded segments separated by dots: header.payload.signature. The header declares the algorithm used for signing. The payload carries the claims: standardized fields like iss (issuer), sub (subject), exp (expiration), and iat (issued at), plus any custom claims your application adds. The signature is computed over the header and payload using the algorithm specified in the header.

Tokens are not encrypted by default. Anyone who intercepts a JWT can read the header and payload. The signature only guarantees integrity, confirming that the token was created by someone with the signing key and hasn’t been modified since.

Standard Claims

Need to convert the exp or iat timestamps to a readable date? Use the Unix Timestamp Converter. Want to examine the decoded JSON more closely? Paste it into the JSON Formatter.