JWT Decoder

Decode and inspect JSON Web Tokens to view header, payload, and signature claims.

  • Developer & Code
  • Runs in your browser
  • Free, no signup

How to use

How to Use JWT Decoder

  1. 1

    Paste your JWT

    Enter the JSON Web Token string you want to inspect.

  2. 2

    View the payload

    See the decoded header, payload, claims, and expiration time.

  3. 3

    Verify the token

    Check if the token is expired or has valid structure.

The guide

Tested tool guide Developer and data tools Checked July 30, 2026

What JWT Decoder does, with a checked example

A JSON Web Token normally contains three dot-separated Base64URL segments: header, payload, and signature. This decoder displays the JSON in the first two segments and interprets common time claims. Decoding is useful for inspection, but it does not prove who issued the token or whether its signature is valid.

Worked example

A concrete input and expected output from the current implementation.

Input

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJiZWUyIiwiaWF0IjoxNzAwMDAwMDAwfQ.

Expected output

Header: {"alg":"none","typ":"JWT"}
Payload: {"sub":"bee2","iat":1700000000}

The two JSON segments decode without a secret. The empty third segment and alg value none mean this example carries no cryptographic signature and must never be trusted for authorization.

How the result is produced

1

Base64URL is decoded locally

Hyphen and underscore are translated to the standard Base64 alphabet, missing padding is restored, and the resulting UTF-8 text is parsed as JSON.

2

Claims are data until verified

Fields such as sub, exp, nbf, iss, and aud describe identity and validity constraints. An application must verify the signature, allowed algorithm, issuer, audience, and time claims before relying on them.

Good uses

  • Inspect a development token while debugging authentication.
  • Confirm whether exp and iat values use Unix seconds.
  • Compare expected issuer or audience values with received claims.

Limits and checks

  • Never paste a live bearer token into a device you do not control.
  • The displayed expiration status depends on the local clock.
  • A readable payload can still belong to a forged or modified token.

Common questions

Does decoding verify the signature?

No. Signature verification requires the expected algorithm and an appropriate key. This page only decodes and presents the token segments.

Why can anyone read a JWT payload?

Standard signed JWTs provide integrity, not confidentiality. Encrypt sensitive claims with an appropriate JWE design or keep them out of browser-visible tokens.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.