TOOL · 08
JWT Decoder
Paste a JSON Web Token to inspect its header, payload and registered claims — expiration status included.
Input
About JSON Web Tokens
A JWT (JSON Web Token) is a compact, signed token used for authentication and data exchange — three Base64URL parts joined by dots: header, payload and signature. This decoder unpacks all three and explains the standard claims (exp, iat, nbf, sub, iss, aud). Note: decoding is not verification — checking the signature requires the secret or public key, which this tool never asks for.
Features
Three parts
Header, payload and signature, decoded and laid out side by side.
Expiry check
exp, iat and nbf claims translated to dates, with a VALID / EXPIRED badge.
Claims table
Registered claims (sub, iss, aud…) explained in plain language.
100% private
Decoded locally — your token never leaves the page.
How to use
-
1
Paste a JWT
Drop in the full token — the Bearer prefix is stripped automatically.
-
2
Read the parts
Header and payload appear as formatted JSON; the signature is shown raw.
-
3
Check the claims
See when the token was issued, when it expires, and whether it is still valid.
Use cases
Debug auth flows
Inspect the token your app actually sends and receives.
Verify expiry
Find out why a session suddenly stops working — usually an expired exp.
API testing
Confirm the claims inside a token before wiring it into a request.
Learning JWT
See how header, payload and signature fit together.
Anatomy of a JWT
{"alg":"HS256","typ":"JWT"}{"sub":"1234567890","iat":1516239022}A JWT is three Base64URL parts joined by dots. Decoding reveals the contents, but only the signature — which needs the secret key — proves authenticity.
FAQ
Does decoding verify the token?
No. Decoding only unpacks the Base64URL parts. Verifying the signature requires the secret or public key, which this tool never asks for.
Is it safe to paste a real token here?
The token is processed locally and never transmitted. Still, avoid pasting production credentials into any web page as a habit.
Why is my token “EXPIRED”?
The exp claim is a timestamp in the past. Tokens are short-lived by design — refresh it from your auth server.