JWT decoder
Paste a JSON Web Token to inspect its header, payload, and expiry. Decoding happens entirely in your browser — nothing is sent to a server.
Token
This token has no signature segment — it is unsigned. Treat it as untrusted.
Expiry status
Header
| Claim | Value | Description |
|---|---|---|
Raw JSON
Payload
| Claim | Value | Description |
|---|---|---|
Raw JSON
Signature
Base64url-encoded signature segment:
Signature NOT verified — verification requires the secret or public key. This tool only decodes.
About this tool
Paste a JWT and this tool splits it into header, payload, and signature segments. You get a readable table of registered claims (issuer, subject, expiry, and the rest) plus raw JSON you can copy while debugging auth.
Reach for it when you are tracing a login flow, checking why a token expired, or reading what your app put in custom claims. It is a decoder, not a validator — seeing the payload does not mean the token is trustworthy.
Signatures are shown but never verified here. You need the issuer's secret or public key for that. Reject tokens with a missing signature or alg: none in production, and avoid pasting live production tokens into any online tool as a habit.
Decoding happens entirely in your browser. Nothing is logged or sent over the network.
Read more
- JSON Web Token (JWT) explained — how JWTs work and when to use them
- Auth with GraphQL, Apollo, JWT and cookies
- Introduction to JSON — the format JWTs are built on
Free books, courses, and software
Get my programming books, course editions, and complete software.
Get the download library →