JWT decoder
Decode and inspect JWT tokens
Paste a full JWT — three Base64URL segments separated by periods.
This tool runs entirely in your browser. Your token is never uploaded or sent to a server.
About this tool
JSON Web Tokens (JWT) are digitally signed credentials commonly used for authentication and authorization. They encode user information, expiration dates, and permissions as a JSON payload. While the token is signed, the content is not encrypted — it's simply Base64-encoded. This tool decodes the payload to inspect what's inside, making it invaluable for debugging authentication issues, understanding token claims, and verifying the structure of JWTs from your application or third-party APIs.
Common uses
- › Inspecting JWT claims and payload during authentication debugging
- › Checking token expiration times and other metadata
- › Verifying that a JWT contains the expected claims and values
- › Understanding the structure of JWTs from third-party APIs
- › Extracting user ID or permission data from a token
Example
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cHeader: { "alg": "HS256" }
Payload: { "sub": "1234567890", "name": "John Doe" }Technical notes
- › Decoding a JWT is not the same as verifying it — anyone can decode a token and read its claims without the secret key, since the payload is only encoded, not encrypted.
- › This tool does not and cannot verify a JWT's signature in the browser using the actual secret, since that would mean exposing your signing secret client-side. Signature verification must happen server-side.
- › Never store sensitive data (passwords, secrets, personal data beyond what's necessary) in a JWT payload — since it's trivially readable by anyone who has the token.
FAQ
Is decoding a JWT the same as verifying it's authentic?
No. Decoding just reads the Base64-encoded payload — it doesn't confirm the token was actually issued by a trusted server or that it hasn't been tampered with. Only signature verification (with the correct secret or public key) confirms authenticity.
Can anyone read the contents of a JWT?
Yes — the payload is only encoded, not encrypted, so anyone with the token can decode and read its claims. Never put sensitive information in a JWT payload.
Why does my token show as expired?
The exp claim is a Unix timestamp for when the token expires. If that time has passed, the token is expired — the application issuing it should reject expired tokens even if the signature is valid.