JWT Decoder
Decode and inspect JSON Web Tokens (JWT) instantly with header and payload analysis, claim validation, and security-focused design. Perfect for debugging authentication, API development, and security auditing with comprehensive error handling and example tokens.
Continue Your Code Journey
What is JWT Decoder?
The JWT Decoder parses a JSON Web Token and displays its header and payload as formatted JSON. It Base64-decodes the header and payload segments, pretty-prints the JSON, and highlights standard claims like iss, sub, exp, iat, and aud. The tool does not verify the signature. All processing happens in the browser.
How does JWT Decoder work?
This tool splits a JWT string on the period (.) delimiter, Base64-decodes the first segment (header) and second segment (payload), and displays them as formatted JSON. The third segment (signature) is shown but not decoded or verified.
Key Features
- Decodes JWT header and payload
- Formatted JSON output
- Highlights standard claims (exp, iat, iss, sub, aud)
- Shows expiration time in human-readable format
- Copy header or payload to clipboard
- Error messages for malformed tokens
- Decodes header, payload, and signature segments without verifying
- Real-time decoding
Common Use Cases
Debugging authentication issues
Decode a JWT from a failed API request to inspect the claims and expiration.
Inspecting token contents
View the user ID, roles, and permissions encoded in a JWT.
Checking token expiration
Verify whether a JWT has expired by checking the exp claim.
Learning JWT structure
Understand how JWTs are structured with header, payload, and signature segments.
How to Use This Tool
Paste the JWT
Enter the complete JWT string (three Base64 segments separated by periods).
Decode
Click Decode. The tool shows the header and payload as formatted JSON.
Inspect the claims
Review the decoded claims including expiration, issuer, and subject.
Pro Tips
- 1
JWTs have three segments separated by periods: header.payload.signature.
- 2
The exp claim is a Unix timestamp. The tool converts it to a readable date.
- 3
This tool decodes but does not verify. Use a JWT library for verification in production.
- 4
Never share real JWTs with third parties. They grant access to the encoded claims.
Frequently Asked Questions
What is a JWT?
JWT decoder reads a JSON Web Token, a compact URL-safe token format used for authentication and information exchange. It consists of a header, payload, and signature.
Does this tool verify the signature?
No. The tool only decodes the header and payload. Signature verification requires the secret key or public key, which this tool does not use.
Is my token sent to a server?
No. All decoding happens in your browser. The token never leaves your device.
What standard claims are highlighted?
iss (issuer), sub (subject), aud (audience), exp (expiration), iat (issued at), nbf (not before), and jti (JWT ID).
Can I decode expired tokens?
Yes. The tool decodes any JWT regardless of its expiration. The exp claim shows when the token expired.