JWT Decoder

JWT Decoder splits a JSON Web Token into its three parts and base64url-decodes the header and payload into readable JSON, right in your browser. Paste a token and it shows the algorithm and claims, plus an expiry banner that reads the exp claim to tell you whether the token is still valid. It decodes only and does not verify the signature.

JWT Token

This tool only decodes the JWT. It does not verify the signature. Never paste sensitive production tokens into online tools.

How was this tool?

Your feedback helps us improve JWT Decoder.

Why use JWT Decoder?

JWT Decoder takes a JSON Web Token and pulls it apart into the three segments every JWT carries: the header, the payload, and the signature. The first two segments are base64url encoded JSON, so the tool converts the URL-safe characters back, restores the padding, and parses each into an object that is shown as indented JSON. The header typically reveals the signing algorithm and token type, while the payload holds the claims such as the subject, issued-at time, and any custom fields the issuer added. The signature is displayed as its raw string because verifying it would require the issuer's secret or key. One detail that saves real debugging time is the expiry banner. If the payload includes an exp claim, the tool compares that Unix timestamp against the current time and tells you whether the token is expired or still valid, and it prints the exact expiration date and time in your local format. That answers the most common question when an API starts returning 401s: is the token stale, or is something else wrong. If the token you paste does not split into exactly three dot-separated parts, you get a clear "Invalid JWT: must have 3 parts" message instead of a confusing failure. For legitimate use and data handling, this is a read-only inspection tool that decodes and never verifies: the entire operation runs in your browser with base64 decoding and JSON parsing, the token is not uploaded anywhere, and the page still warns against pasting sensitive production tokens into any online tool. It is meant for reading tokens you already hold while building and debugging your own applications, not for validating that a token is genuine.

Key benefits

Turns an opaque token string into readable JSON for the header and payload in one click
Reads the exp claim and tells you at a glance whether the token is expired, with the exact expiry timestamp
Decodes entirely in your browser, so the token is never sent to a server
Handles base64url encoding correctly, converting the URL-safe characters and padding before decoding
Shows a clear error when a token does not have the three required parts

Features

Decodes the header, payload, and signature of a standard three-part JWT
Base64url decoding that restores + and / characters and adds padding before parsing
Expiry check driven by the exp claim, comparing it against the current time
Human-readable expiration date rendered from the exp Unix timestamp
Header and payload output as indented, copy-friendly JSON
Clear button to reset the token box and results instantly

Popular use cases

A developer debugging why an API rejects a request, checking the payload claims and whether the token has expired
Inspecting the alg and typ in a token's header while integrating an auth provider or SSO flow
Reading custom claims such as sub, roles, or scopes to confirm the right data was encoded
Confirming a token's expiration date and time when troubleshooting session timeouts

How to use JWT Decoder

1
Paste your token
Paste your JWT into the JWT Token box. It expects the standard three dot-separated segments (header.payload.signature).
2
Decode it
Click Decode JWT. The button stays disabled until you enter a token, so it only runs once there is something to read.
3
Read the header and payload
Review the Header, Payload, and Signature sections shown as pretty-printed JSON. The header reveals the alg and typ, and the payload lists every claim in the token.
4
Check expiry
If the payload has an exp claim, an expiry banner shows whether the token is expired or still valid, along with the exact expiration date and time.
5
Clear and reuse
Click Clear to wipe the token box and results, then paste another token to inspect it.

Frequently asked questions

Does this verify the JWT signature?

No. This tool only decodes the token to show its contents. It does not check the signature against a secret or public key, so a decoded payload is not proof that the token is authentic or untampered.

Is my token sent to a server?

No. Decoding happens entirely in your browser using base64 decoding and JSON parsing, so the token never leaves your device. As the on-page warning notes, you should still avoid pasting sensitive production tokens into any online tool.

How does it know if the token is expired?

It reads the exp claim from the payload, which is a Unix timestamp, and compares it to the current time. If exp is in the past you see an expired banner; otherwise it shows the token as valid along with the exact expiry date. Tokens without an exp claim show no expiry banner.

Why do I get an "Invalid JWT: must have 3 parts" error?

A JWT must have three segments separated by dots: header, payload, and signature. If your input has more or fewer dot-separated parts, the decoder reports this error. Make sure you pasted the whole token and nothing extra.

Can I decode more than one token at a time?

No, it decodes one token per run. Paste a token, click Decode JWT, then use Clear and paste the next one to inspect it.

Can it re-encode or sign a token?

No. This is a read-only decoder. It does not create, sign, or re-encode tokens, and it leaves the signature as its raw string without validating it.

Last reviewed: July 2026

How was this tool?

Related tools