Paste any JSON Web Token to instantly decode the header, payload, claims, and expiry.
Add this JWT Decoder to your website or blog for free — just paste this code:
Yes — this tool runs 100% in your browser. Your token is never sent to any server. You can verify this by going offline before pasting. That said, avoid pasting production tokens with sensitive claims into any online tool as a general security practice.
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts: Header (algorithm & type), Payload (claims), and Signature. JWTs are commonly used for authentication and API authorization.
No — verifying a signature requires the secret key or public key used to sign the token. This tool only decodes the publicly readable parts (header and payload). Signature verification must be done server-side where the secret is held.
The "exp" claim (Expiration Time) is a Unix timestamp representing when the token expires. This decoder shows it in human-readable form and tells you whether the token is currently valid or has expired.
Common algorithms include HS256 (HMAC-SHA256, symmetric), RS256 (RSA-SHA256, asymmetric), and ES256 (ECDSA, asymmetric). The algorithm is shown in the "alg" field of the header.
This JWT decoder reads the header and payload of a JSON Web Token and displays their contents in clean, human-readable JSON — entirely in your browser. It helps developers debug authentication flows, inspect claims like exp and iss, and confirm exactly what data an API is receiving without wiring up extra logging.
A JWT is three Base64URL-encoded sections separated by dots: the header, the payload, and the signature. The decoder splits the token on the dots, Base64URL-decodes the first two sections, and parses them as JSON so you can read the algorithm, token type, and every claim without a server round trip.
It does not verify the signature, because that requires the secret or public key held by the issuer. Instead it focuses on decoding — showing you the exact claims and converting time-based fields such as iat (issued at) and exp (expiry) from Unix timestamps into readable dates. Because the header and payload are only encoded, not encrypted, anyone can read them; this tool simply makes that built-in transparency convenient while keeping your token on your own machine.
{"sub":"1234","name":"Ada","iat":1710000000} reveals the subject, name, and issued-at time at a glance.exp value of 1735689600 is shown as 01 Jan 2025 00:00:00 UTC, making it obvious whether a token has already expired.Yes — this tool runs 100% in your browser. Your token is never sent to any server.
A JSON Web Token is a compact, URL-safe way to represent claims. It consists of Header, Payload, and Signature parts.
No — verifying a signature requires the secret key. This tool only decodes the publicly readable header and payload.
The 'exp' claim is a Unix timestamp for when the token expires. This decoder shows it in human-readable form.
Common algorithms: HS256 (HMAC-SHA256), RS256 (RSA-SHA256), ES256 (ECDSA). Shown in the 'alg' header field.