JWT Decoder
Paste a JWT token and instantly see the decoded header, payload, and all claims including expiry time. Nothing is sent to any server - it decodes right in your browser. Handy for debugging auth issues without opening a separate tool.
How to use
- Paste your JWT token into the input field.
- Click Decode and you'll see the header and payload broken out separately.
- Expiry time is shown in a readable format so you can see at a glance if the token is still valid.
- Your token stays in the browser - nothing goes to any server.
Related tools:
A JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and data exchange between services. It consists of three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims/data), and a signature (for verification). This decoder lets you inspect the first two parts instantly.
Important: decoding a JWT does not verify its signature. Anyone can decode a JWT. The security comes from the server verifying the signature using a secret or public key. Never put sensitive data in a JWT payload unless the token is also encrypted (JWE). Common payload claims include: sub (subject/user ID), exp (expiry timestamp), iat (issued at), and iss (issuer).
Frequently Asked Questions
Is it safe to paste my JWT here?
All decoding happens in your browser. No token is sent to any server. However, treat JWTs like passwords: avoid pasting production tokens into any online tool unless you fully trust it. For sensitive tokens, decode offline using jwt.io's offline mode or a local script.
Why can't I verify the signature here?
Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/EC algorithms like RS256). Without the key, you can only decode the payload, not verify it. Use your server-side library for proper verification.
What does 'Token expired' mean?
The exp (expiration) claim in the payload is a Unix timestamp. If it's in the past, the token is expired and any server using it should reject it. Servers typically issue new tokens using a refresh token flow.
What is the difference between JWT and session cookies?
A session cookie stores a session ID server-side; the server looks up the session on each request. A JWT is self-contained: the server validates the token signature without a database lookup, making it stateless and scalable. JWTs are popular in microservices and SPAs.