JWT Decoder

How to use the JWT Decoder

1. Paste your JSON Web Token into the input field.
2. The decoded header and payload appear automatically below.
3. Review the claims, including algorithm, issuer, subject, and any custom fields.
4. Check the expiration status to see if the token is still valid.
5. Copy any decoded section as needed for your debugging workflow.

Decoding is not the same as verifying

This tool decodes and displays a JWT's contents. It does not verify the signature. That distinction matters because anyone can decode a JWT and read its payload (it's Base64, not encryption), but only someone with the correct secret or private key can produce a signature that a server will actually accept. If you're debugging why a token is being rejected by an API, decoding here tells you what's inside the token (is the `exp` claim actually in the future? does `sub` match what you expect?), but signature validation failures require checking against the actual secret/key on the server side.

Frequently asked questions

Does this verify the token's signature?

No. It decodes the header and payload for inspection only. Signature verification requires the signing secret or public key, which this tool never asks for and never needs.

Is it safe to paste a production JWT into this?

Decoding happens entirely in your browser and nothing is sent to a server, but as general practice, avoid pasting tokens containing sensitive live session data into any third-party tool, even a client-side one. Use a redacted or expired token for debugging when possible.

Why does the `exp` field show a strange number instead of a date?

JWT timestamp claims (`exp`, `iat`, `nbf`) are stored as Unix epoch seconds; the tool converts this to a human-readable date for you automatically.