Add your input
A three-part JWT string.
Code drawer
JWT decoder
Inspect token claims and expiration without sending them anywhere.
Privacy built inYour work stays with you
Decode only: this tool does not verify the signature or prove that a token is authentic. Avoid pasting active production credentials into any tool.
Your work stays private in your browser while you use this tool.
What does jwt decoder do?
Decode the Base64URL JSON header and payload of a three-part JSON Web Token, display its untouched signature segment, and interpret a numeric exp claim against the current clock. It does not validate authenticity.
- Input
- A three-part JWT string.
- Result
- Readable header and payload JSON.
- Price
- Free
- Account
- Not required
How to use jwt decoder
Choose your settings
Inspect token claims and expiration without sending them anywhere.
Save or copy
Readable header and payload JSON.
A practical tip
Decoding does not verify the signature; never trust a token until your server validates it.
When to use jwt decoder
Inspect an algorithm header and claim names while debugging an authentication integration.
Check whether a numeric expiration claim appears past or future on the current device.
Copy readable header and payload JSON for a local test report without claiming the token is valid.
Worked example
A concrete jwt decoder example
- Input
- eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJleHAiOjQxMDI0NDQ4MDB9.demo
- Result
- The header decodes to {"alg":"HS256","typ":"JWT"}; the payload decodes to {"sub":"123","exp":4102444800}. The page reports the numeric expiration as not expired before 2100, but makes no statement about the demo signature's validity.
What to expect
How it works
The input must split into exactly three dot-separated segments. The first two are normalized from Base64URL, padded, decoded as strict UTF-8, and parsed as JSON. If payload.exp is numeric, seconds are multiplied by 1,000 and compared with Date.now(); the third segment is only displayed.
Know before using
Limits and edge cases
- No cryptographic signature, key, issuer, audience, nonce, algorithm policy, or other claim is verified. Decoded content must always be treated as untrusted.
- Only a numeric exp claim receives special handling, using the current device clock and locale display. Encrypted JWE tokens and malformed or non-JSON segments are unsupported.
Standards and sources
Common questions
JWT decoder FAQ
Is jwt decoder free to use?
Yes. JWT decoder is free to use.
Does jwt decoder keep my work private?
Yes. Your work stays private while you use the tool — nothing you enter is uploaded.
Does a readable payload mean the JWT is valid?
No. Anyone can construct readable header and payload segments. A trusted verifier must validate the signature and enforce the expected algorithm, key, issuer, audience, time claims, and application policy.
How does the decoder interpret exp?
When exp is a JSON number, the tool treats it as Unix seconds, converts it to a local date string, and compares it with the current browser time. Other claim types are displayed without interpretation.