JWT Decoder
Decode and inspect JWT tokens — view header, payload and signature
JWT is decoded client-side. No data is sent to any server.
About This Tool
JSON Web Tokens (JWT) are widely used for authentication and information exchange in modern web applications. This free online JWT decoder lets you inspect the contents of any JWT token — header, payload, and signature — without sending your token to any server.
Use this tool to debug authentication flows during development, verify JWT claims like issuer (iss), subject (sub), and expiration (exp), check if a token has expired, and understand the structure of JWT tokens for learning or troubleshooting.
The decoder automatically parses all three parts of the JWT, detects when the token has expired (with visual indicators), and includes a sample token so you can try the tool immediately. All decoding is done client-side — your tokens never leave your browser.
How to Use
- Paste the JWT token into the input box.
- Inspect the decoded header, payload and signature in separate panels.
- Check the expiry claim — the tool flags expired tokens in red.
- Use the sample token button to see a well-formed example.
Tip: Decoding shows what the token claims — it never proves the claims are true. Signature verification happens on your server.
Common Mistakes
1. Trusting decoded claims
Decoding is not verification. Anyone can craft a token with any payload, so every claim must be checked against a verified signature on the backend before access is granted.
2. Storing sensitive data in the payload
The payload is plain Base64 — readable by anyone who holds the token. Personal data, secrets and internal identifiers do not belong there.
3. Seconds versus milliseconds
The expiry and issued-at claims use seconds since the epoch, while JavaScript timestamps are milliseconds. Compare like with like or every token looks expired or eternally valid.
4. Accepting any algorithm
Servers must pin the expected signing algorithm. Attacks have exploited tokens that switch the header algorithm to none and slip through unverified.