JWT Decoder
Decode a JSON Web Token to read its header and payload, see the expiry, and inspect claims — entirely in your browser. Free.
Decode a JWT
Paste a JSON Web Token to read its header and payload.
What this JWT decoder does
Common use cases
- 1Inspecting an auth token
- 2Debugging claims and scopes
- 3Checking a token's expiry
- 4Reading the algorithm used
- 5Understanding an API's JWTs
- 6Learning JWT structure
Related tools
About JSON Web Tokens
A JWT has three base64url parts — header.payload.signature. The header and payload are just encoded JSON (not encrypted), so anyone can read them; the signature lets a server verify the token wasn't tampered with.
This decoder shows the header and payload and the expiry, but it does not verify the signature — that requires the secret or public key held by the issuer. Because contents are readable by anyone, never put secrets in a JWT payload, and never trust a token you haven't verified server-side. Decoding happens entirely in your browser.
More Free Tools Where This Came From
This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.
HostCloud.in · Pune, India · Serving 34,987+ Websites Since 2020
Got Questions? We Have Answers.
Does it verify the signature?
No. It only decodes the header and payload. Verifying the signature needs the secret or public key, which only the issuer holds — never trust an unverified token.
Is my token sent to a server?
No. Decoding happens entirely in your browser, so even sensitive tokens are safe to paste.
Why can I read the payload?
A JWT payload is only base64url-encoded JSON, not encrypted. Anyone can read it — which is why you should never put secrets in a JWT.
Does it show expiry?
Yes. If the token has an exp claim, the tool shows the expiry time and whether it has passed.