JWT Decoder
🔒 Your token never leaves your browser — it is not sent to any server.
About This Tool
Instantly decode JWT tokens and inspect Header, Payload, and standard claims — exp, iat, sub, iss, aud and more — with human-readable explanations. Everything runs in your browser; your token never leaves your device.
A JWT (JSON Web Token) has three parts: Header (algorithm and token type), Payload (claims — user info, expiry, etc.), and Signature (for integrity, not verified by this tool). This decoder reads the Header and Payload and shows you their contents, but does not verify the signature.
How To Use
- Paste your JWT token — copy it from your browser devtools, API client, or authentication response.
- Click Decode — the Header and Payload are displayed immediately in a readable format.
- Review the standard claims — if the Payload contains registered claims (exp, iat, sub, iss, aud, etc.), human-readable explanations appear automatically below the JSON blocks.
Example
Try pasting this sample token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEyMyIsIm5hbWUiOiJKYW5lIERvZSIsImlhdCI6MTUxNjIzOTAyMiwiZXhwIjoxNTE2MjQyNjIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This token's Payload contains sub, name, iat, and exp claims. The exp timestamp is in the past, so the "expiry time has passed" indicator will appear — this is a time comparison, not a signature check.
Frequently Asked Questions
- Can I verify whether this token is actually valid (i.e. check the signature)?
- No — this tool only decodes the token (reads the Header and Payload), it does not verify the cryptographic signature. Signature verification requires the secret key or public key used to sign the token, which this tool does not and should not handle. Use your backend or a trusted library (e.g. jsonwebtoken for Node.js) to verify signatures.
- Is my token sent to any server?
- No. The entire decoding process runs in your browser using JavaScript. Your token is never sent to any server, logged, or stored anywhere — not even in browser storage. This is especially important because JWT tokens often contain sensitive authentication data.
- The "exp" claim shows it has passed — does that mean the token is invalid?
- It means the declared expiry timestamp in the Payload is in the past. However, this is just a time comparison — it is not the same as verifying the signature. A token can have a past exp and still technically have a valid signature, and vice versa. Whether the token is truly accepted or rejected is always determined by the server that validates it.