Decode and inspect JSON Web Tokens (JWT). View header, payload, claims, expiration status, and signature without needing the secret key
Paste a JSON Web Token and instantly see its decoded header, payload, and signature. The decoder parses the three Base64URL-encoded segments and presents them as formatted JSON, making it easy to inspect claims, expiration times, and signing algorithms without writing any code.
Initializing in your browser…
An API call returns 401 and you need to see whether the token your client sent is expired or missing a scope.
JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Decoded
Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
iat → 2018-01-18 01:30:22 UTCA JWT is three base64url segments, header.payload.signature, so the claims are readable without the secret (the tool also renders `iat`/`exp` as human dates so you can spot expiry instantly). Decoding does not verify the signature, so never trust an unverified token server-side: anyone can read, and forge, the unsigned parts.
Paste a JSON Web Token and instantly see its decoded header, payload, and signature. The decoder parses the three Base64URL-encoded segments and presents them as formatted JSON, making it easy to inspect claims, expiration times, and signing algorithms without writing any code.
Inspect the claims inside an access token to troubleshoot authentication or authorization issues.
Quickly see when a token was issued and when it expires without decoding manually.
Review what data is stored in a JWT to ensure no sensitive information is exposed in the payload.
Visualize the JWT structure to understand how claims-based authentication works.
A JWT consists of three parts separated by dots: the header (which specifies the algorithm and token type), the payload (which carries the claims, data like user ID, roles, and expiration), and the signature (which verifies the token has not been tampered with). This tool decodes the first two parts, which are simply Base64URL-encoded JSON. It does not verify the signature, since that requires the signing key.
No. Signature verification requires the secret key or public key, which this client-side tool does not have. It only decodes the header and payload.
Yes. Everything runs in your browser. The token is never sent to any server.
"exp" is the expiration time and "iat" is the issued-at time. Both are Unix timestamps representing seconds since January 1, 1970.
Conversions run on your device in JavaScript. The values you enter are never sent over the network.