📖 What is JWT Decoder?
A JWT (JSON Web Token) Decoder lets you inspect the contents of a JWT without needing the secret key. It decodes the Base64-encoded header and payload sections, revealing the claims, algorithm, expiry time and other metadata inside the token.
💡 Example
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkFsaWNlIiwiaWF0IjoxNTE2MjM5MDIyfQ.sig
Output
── HEADER ──
{
"alg": "HS256",
"typ": "JWT"
}
── PAYLOAD ──
{
"sub": "1234",
"name": "Alice",
"iat": 1516239022
}
Status: ✓ Valid
🛠️ Common Use Cases
- Debugging authentication issues in APIs
- Inspecting token claims during development
- Checking token expiry without running code
- Understanding JWT structure for learning
- Verifying token contents in code reviews
❓ Frequently Asked Questions
Is it safe to decode a JWT here? ▾
Decoding is safe — the decoder only reads the Base64-encoded payload which is publicly readable. The signature is not verified here. Never share JWTs with sensitive payloads in untrusted tools.
Can this tool verify JWT signatures? ▾
No — signature verification requires the secret key. This tool only decodes the readable parts (header and payload). Use the JWT Generator to create signed tokens.
What is a JWT used for? ▾
JWTs are used for authentication (login tokens), authorization (permission claims), and secure data exchange between services. They are commonly used in REST APIs with Bearer token authentication.
Why is my token showing as expired? ▾
JWTs contain an 'exp' claim (Unix timestamp). If the current time is past that timestamp, the token is expired. Generate a new token or extend the expiry time.
🔒
Your data stays private. All processing happens entirely in your browser using JavaScript. Nothing is ever sent to our servers. You can even use this tool offline after the page loads.