JWT Decoder

Decode and inspect JWT tokens instantly. View header, payload, and expiry without any server call. Paste your JWT to see all claims.

How to use

  1. Paste a JWT token into the input field.
  2. Click Decode to see the header and payload.
  3. Check expiry time and other claims.
  4. No token is sent to any server.

Related tools:

Base64 Encoder/DecoderJSON FormatterURL Encoder / Decoder

A JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and data exchange between services. It consists of three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims/data), and a signature (for verification). This decoder lets you inspect the first two parts instantly.

Important: decoding a JWT does not verify its signature. Anyone can decode a JWT — the security comes from the server verifying the signature using a secret or public key. Never put sensitive data in a JWT payload unless the token is also encrypted (JWE). Common payload claims include: sub (subject/user ID), exp (expiry timestamp), iat (issued at), and iss (issuer).

Frequently Asked Questions

Is it safe to paste my JWT here?

All decoding happens in your browser — no token is sent to any server. However, treat JWTs like passwords: avoid pasting production tokens into any online tool unless you fully trust it. For sensitive tokens, decode offline using jwt.io's offline mode or a local script.

Why can't I verify the signature here?

Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/EC algorithms like RS256). Without the key, you can only decode the payload, not verify it. Use your server-side library for proper verification.

What does 'Token expired' mean?

The exp (expiration) claim in the payload is a Unix timestamp. If it's in the past, the token is expired and any server using it should reject it. Servers typically issue new tokens using a refresh token flow.

What is the difference between JWT and session cookies?

A session cookie stores a session ID server-side; the server looks up the session on each request. A JWT is self-contained — the server validates the token signature without a database lookup, making it stateless and scalable. JWTs are popular in microservices and SPAs.