ToolsBench

JWT Decoder

Inspect a JSON Web Token's header and payload.

Input
Output

About JWT Decoder

A JSON Web Token (JWT) is the standard way modern APIs prove who you are: a header, a payload of claims, and a signature, each Base64-encoded and joined with dots. This decoder splits a token and shows the header and payload as readable JSON — useful when debugging auth flows, checking expiry times, or inspecting what claims a token actually carries.

How to use JWT Decoder

1
Paste the token
Paste the full JWT — the three dot-separated parts starting with eyJ. Click Sample to see one.
2
Read header and payload
Both are decoded and pretty-printed. Look for claims like exp (expiry), sub (subject) and iat (issued at).
3
Check the timestamps
exp and iat are Unix timestamps (seconds). An expired exp is the most common reason a token is rejected.

Frequently asked questions

Is it safe to paste a real token here?
The token never leaves your browser — decoding happens locally and nothing is transmitted or stored. Still, treat production tokens like passwords and prefer expired or test tokens when you can.
Does this verify the signature?
No. Decoding shows the contents; verifying the signature requires the secret or public key, which only the issuing server should hold.

Go deeper