Paste a JSON Web Token to instantly decode its header and payload, see every claim, and check whether it is expired, valid, or not yet active. Decoding runs entirely in your browser, so the token never leaves your device.
Start decoding a tokenPaste a token and click Decode, or load the sample.
–
–
–
JSON Web Tokens are widely used for authentication and authorization: a server issues a signed token, and the client sends it back with each request. This tool decodes the header and payload of any JWT so you can inspect its claims, check expiry, and debug authentication issues, all without sending the token anywhere. It does not check the signature, since that requires the original signing key.
Instantly decode both segments into readable, syntax-highlighted JSON.
See whether a token is valid, expired, or not yet active based on its exp and nbf claims.
Standard claims like iss, sub, aud, iat, exp, and nbf are converted into a plain-language table.
Decoding happens locally in your browser. The token you paste is never uploaded or logged.
Copy the header or payload individually, or download both as a single decoded JSON file.
Built-in reminders that JWTs are encoded, not encrypted, and that this tool does not verify signatures.
| Input | Decoded result |
|---|---|
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.abc123 |
Header: {"alg":"HS256"}, Payload: {"sub":"1234"} |
A token with "exp": 1700000000 |
Claims table shows the expiry as a readable date, plus a Valid or Expired status. |
| A token with only two segments (missing signature) | An error explaining that a JWT needs exactly three dot-separated segments. |
A JWT (JSON Web Token) is a compact, URL-safe token made of a header, a payload, and a signature, separated by dots. This tool decodes the header and payload back into readable JSON and shows the raw signature.
No. This tool only decodes the header and payload for inspection. It does not verify the signature, since that requires the secret key or public key used to sign the token.
No. Decoding happens entirely in client-side JavaScript in your browser. The token you paste is never sent to a server or logged.
No. A standard JWT is Base64URL-encoded, not encrypted, so anyone who has the token can read its header and payload. Never store secrets or sensitive personal data directly inside a JWT payload.
exp is the expiration time, iat is when the token was issued, and nbf is the earliest time the token becomes valid. This tool converts each of these Unix timestamps into a readable date and shows whether the token is currently valid, expired, or not yet valid.
A JWT often represents an active login session. Anyone who obtains a valid, unexpired token can potentially use it to impersonate the user it belongs to, so treat tokens like passwords and avoid pasting production tokens into untrusted tools.
A JWT must have exactly three dot-separated Base64URL segments. An error usually means the token was truncated, has extra whitespace, or is missing a segment when it was copied.