JWT Decoder
Inspect token contents and expiry
Loadingโฆ
Was this tool helpful?
About this tool
This tool decodes the header and payload of a JWT (JSON Web Token) and shows the claims inside. A token has three dot-separated parts (header, payload, signature); this tool only Base64URL-decodes the first two into JSON and does not verify the signature. If an exp claim is present, it also tells you whether the token has expired.
How to use
- Paste a token into the input box, or click the sample button to load a demo token.
- The header and payload โ the first two of the three dot-separated parts โ are each expanded as JSON.
- If the payload has an exp claim, an expired/valid badge and the expiry time are shown.
- Use the copy button to grab the header or payload JSON.
Frequently asked questions
- Is decoding a JWT different from verifying its signature?
- Yes, completely different. This tool only reads the token's contents โ it does not confirm the signature is genuine. Verifying a signature requires a secret (or public) key known only to the issuer, and this tool neither asks for nor accepts a key.
- If it shows "expired", is the token now unusable?
- This is just informational โ it compares the payload's exp claim to the current time. Whether the token is actually rejected depends on the server's own verification logic.
- Why can't the signature part be decoded into readable content?
- The signature is the result of signing the header and payload with a secret key โ it is not data that can be reversed into plain text. This tool simply displays the signature string as-is.
- Is the token I enter sent to a server?
- No. All decoding happens in your browser, and the token is never sent to a server.
This page only decodes tokens โ it does not verify signatures โ and never sends the token you enter to a server. A token can look unexpired and still have a forged signature, so any real authentication must go through server-side verification.