Free Tools /Development
JWT Decoder
Paste a JWT to instantly see its header, payload, and expiry status, decoded and formatted, entirely in your browser.
Known claims, decoded
Header
Full payload
How this tool works
Splits and decodes each segment
A JWT is three Base64URL-encoded segments separated by dots: header, payload, and signature. This tool splits on the dots and decodes the first two segments into readable JSON.
Flags expiry automatically
If the payload contains an "exp" claim, the tool converts it to a real date and tells you immediately whether the token is expired, and by how much.
The signature is never verified
This tool decodes and displays the signature segment as-is but does not and cannot verify it without your signing secret, which you should never paste into any third-party tool.
Frequently asked questions
Is it safe to paste a real production JWT here?
The decoding happens entirely in your browser, nothing is transmitted anywhere. That said, treat any JWT as sensitive: it may contain user IDs, roles, or scopes. Prefer using an expired or test token when possible.
Why can this tool read the payload without my secret key?
By design, JWT payloads are only Base64URL-encoded, not encrypted, meaning anyone who intercepts a token can read its contents. The signature is what prevents tampering, not the payload's readability. Never put sensitive data in a JWT payload for this reason.
What does the "exp" claim actually mean?
"exp" is a Unix timestamp (seconds since Jan 1, 1970) marking when the token expires. Most authentication failures with a valid-looking token are simply an expired "exp" claim, which this tool checks automatically.
Why does my JWT show an error when decoding?
Usually because the pasted string is missing a segment (should have exactly 2 dots), has extra whitespace or line breaks, or is not actually a JWT (some APIs return opaque tokens that only look similar).
Can I use this to build a JWT for testing, not just decode one?
No, this tool is read-only decoding. Constructing a valid signed JWT requires your actual signing secret and algorithm, which should happen server-side or in your own trusted tooling, never in a public browser tool.
More free tools
Base64 & URL Encoder / Decoder
Encode or decode Base64 and URL-encoded strings instantly, both directions, auto-detected.
Timestamp & Timezone Converter
Convert Unix timestamps to human dates across timezones, both directions, instantly.
Business Hours & SLA Deadline Calculator
Calculate a real SLA deadline from a start time and business hours, correctly skipping weekends and after-hours.