JWT Decoder
Paste a JSON Web Token to see its header and payload decoded into readable JSON. Useful for checking claims such as expiry or subject while debugging authentication.
⚠️ This tool only decodes JWT. Signature verification is not performed. Use with caution for sensitive tokens.
Common Claims
iss - Issuersub - Subjectaud - Audienceexp - Expirationnbf - Not Beforeiat - Issued AtHow to use
- Paste a JWT into the input field.
- The header and payload decode automatically.
- Read or copy the decoded claims.
Frequently asked questions
- Does decoding a JWT verify it is valid?
- No. Decoding only reads the header and payload; it does not check the signature, so a decoded token can still be expired or tampered with.
- Is it safe to paste a production token here?
- Decoding happens entirely in your browser and the token is never uploaded, but treat any live token as sensitive and avoid pasting one you would not want exposed on screen.
Privacy
The token is decoded in your browser and is never sent to a server.
Related tools
- JSON Formatter
Paste JSON to indent it, minify it, or find the exact position of a syntax error. Everything runs in your browser, so payloads never leave the page.
- Base64 Encoder/Decoder
Encode plain text into Base64, or decode Base64 back into plain text, live as you type. Encoding runs in your browser and never touches a server.
- Hash Generator
Enter text and choose a hash algorithm to get a hexadecimal digest live as you type. Hashing runs in your browser, so text never leaves the page.