JWT Decoder
Decode JWT tokens to inspect header, payload and expiry — safely.
Paste a JWT and instantly see its header, payload (user id, roles, expiry) and whether it’s expired. Warning: JWT payloads are only Base64-encoded, not encrypted — never put secrets in them, and never paste production tokens into random websites (this one runs fully offline).
How to use the jwt decoder
- Paste your JWT.
- Inspect header and payload.
- Check the exp claim.
JWT Decoder — FAQs
What are the three parts of a JWT?
Header (algorithm), payload (claims like sub, exp, roles), signature — joined by dots. The signature proves it wasn’t tampered with.
Is the payload encrypted?
No! It’s just Base64 — anyone can read it. Never store passwords or sensitive data in a JWT.
How do I check if a token expired?
Look at the ‘exp’ claim (Unix timestamp). If it’s in the past, the token is dead — this tool flags it automatically.
Is pasting tokens here safe?
This decoder runs 100% in your browser — nothing is sent anywhere. Still, prefer decoding dev/test tokens over production ones.
Keep exploring
People who used this also opened:
Base64 Encoder / Decoder →
Encode and decode Base64 — for tokens, images and data URIs.
devSHA-256 Hash Generator →
Generate SHA-256 hashes of any text — instantly, offline.
devJSON Formatter & Validator →
Format, validate and minify JSON with syntax highlighting.
generateUUID Generator →
Generate v4 UUIDs in bulk for databases, APIs and distributed systems.