Paste a JSON Web Token to instantly decode its header, payload claims, and inspect expiry times. Everything runs client-side — your token never leaves your browser.
This JWT decoder takes any JSON Web Token and instantly splits it into its three parts, then decodes the header and payload so you can read the algorithm, the claims, and the expiry in plain JSON — all without sending the token anywhere.
A JSON Web Token is a compact, URL-safe string made of three base64url-encoded sections joined by dots: a header, a payload, and a signature. The header and payload are not encrypted — they are merely encoded, so anyone can decode and read them. That is exactly what this tool does: it reverses the base64url encoding, parses the JSON, highlights it, and breaks the standard claims (such as iss, sub, aud, iat, exp, and nbf) out into a friendly table with human-readable dates and an at-a-glance expiry badge. Crucially, decoding is not the same as verifying. This decoder does not check the signature, because that requires the secret or public key that signed the token; a JWT can decode perfectly and still be forged or tampered with. Treat the decoded contents as informational only, and verify signatures server-side with a trusted library before trusting any claim. People use it to:
exp and iat claims to see whether a token is expired or freshly issuedalg, kid) a token declaresEverything runs locally in your browser. Your token is never uploaded, logged, or stored on a server — decoding happens entirely on your device. That matters because a JWT is a sensitive credential: anyone holding it can often act as you until it expires. So while it is safe to paste a token here, never share an active token publicly, and be cautious with online decoders that POST your token to a remote server.
Authorization header, a cookie, or an API response into the input box (or click Load Sample to try one).exp badge to see the algorithm and whether the token is still valid or expired.With this tool, yes — decoding is entirely client-side. The token never leaves the browser. Avoid online decoders that POST your token to a server.
No. Verification needs the secret or public key. This tool focuses on inspecting the header and claims — always verify on your server with a trusted library.
The exp claim is a Unix timestamp. If it's in the past, your app should refresh the token using your auth server's refresh endpoint.
A JWT is three base64url-encoded strings joined by dots: header.payload.signature. The structure strip in this tool colour-codes each part so you can see exactly where one ends and the next begins.
The header describes the signing algorithm and token type. The payload holds the claims — the actual data, such as the subject and expiry. The signature is computed over the first two parts to detect tampering, but it is not encryption.
These are registered claims: exp is the expiry time, iat is when the token was issued, and sub is the subject (usually the user). Others include iss (issuer), aud (audience), and nbf (not before). This tool labels and dates them for you.
No. Decoding only reverses the base64url encoding to reveal the header and payload, which anyone can do. Verifying checks the signature against a secret or public key to confirm the token is genuine and unaltered. This tool decodes only — always verify server-side.