๐ JWT Decoder
Decode a JWT (JSON Web Token) to inspect its header and payload contents. It also flags whether the token has expired. Useful for checking a token's contents during API development or debugging an authentication issue.
How to use
- Paste a JWT string into the "JWT Token" field.
- The header and payload are decoded and displayed.
- See whether the token is still valid or expired, based on its exp claim.
FAQ
Does it verify the signature?
No โ this tool only decodes and displays the header and payload; it does not verify the signature, so no secret key is needed and nothing unsafe happens.
Can it tell me if a token has expired?
Yes โ it checks the exp (expiration) claim in the payload and shows whether the token is expired.
Is my pasted token sent to a server?
No, decoding happens entirely in your browser and nothing is sent externally, so you can safely inspect tokens that contain sensitive claims.
Can I see what standard claims like sub or iat mean?
The decoded payload is shown as plain JSON, so you can see the raw values of standard claims like sub, iat, and exp directly.
What happens if I paste a malformed token?
If the input isn't a valid JWT (header.payload.signature separated by dots), a parse error is shown.