JWT decoder & inspector
Paste a JSON Web Token to read its header and payload, see every claim, and check expiry at a glance. Decoding happens entirely in your browser — the token is never sent anywhere, and the signing key is never needed or asked for.
Paste a token above to decode its header and payload.
Decoding runs entirely in your browser — nothing is sent anywhere. Even so, avoid pasting production tokens into any online tool: a JWT payload is only base64-encoded, not encrypted, so treat it like a password.
The three parts of a JWT
Header
The token type and the signing algorithm (for example alg: HS256).
Payload
The claims — subject, issuer, audience, issued-at and expiry times, plus any custom data.
Signature
Proves the token was issued by a party holding the signing key. Verifying it needs that key.
JWT questions, answered
What is a JWT?
A JSON Web Token is a compact, URL-safe way to represent claims between two parties. It has three parts separated by dots — a header, a payload, and a signature — each base64url-encoded. It is commonly used for authentication and session state.
Does this verify the signature?
No. Verifying a signature requires the signing secret or public key, which this tool does not have and never asks for. It decodes the header and payload so you can read the claims, but it cannot and does not confirm the token is authentic or untampered.
Is a JWT encrypted?
No — a standard JWT is only base64url-encoded, not encrypted. Anyone who has the token can read its payload. That is why you must never put secrets in a JWT payload, and why you should treat a token itself like a password.
Is my token sent to a server?
No. Decoding happens entirely in your browser with JavaScript. Nothing you paste is transmitted, logged, or stored. As a rule, still avoid pasting live production tokens into any web tool.
How do I know if a token is expired?
The exp claim holds an expiry time as seconds since 1970 (Unix epoch). This tool reads it, converts it to a readable date, and tells you whether that moment is in the past. Note this reflects the claim inside the token, not whether the issuing server still considers the session valid.
Worried about how your app handles tokens?
Weak JWT handling — the none algorithm, unverified signatures, secrets in the payload — is a classic web-app finding. Compare independent, accreditation-verified UK penetration testing companies in our directory.
Browse the directory