JSONFormatting.org

JSON Developer Tool

JWT Decoder

Paste a JSON Web Token to decode its header and payload and inspect the claims inside.

Home › Tools › JWT Decoder
Header
Decoded header will appear here
Payload
Decoded payload will appear here

Decode a JSON Web Token (JWT)

A JWT is made of three Base64URL-encoded parts separated by dots: a header, a payload, and a signature. This tool decodes the header and payload so you can inspect the claims inside a token — useful when debugging authentication flows, checking an access token's expiry, or verifying which scopes/roles a token grants.

This tool only decodes — it does not verify the signature. Decoding a JWT does not prove it's authentic or untampered; only verifying the signature against the correct secret or public key does that. Treat any JWT you paste here as sensitive: it may contain user identifiers, session data, or other claims. Everything still happens locally in your browser and is never sent anywhere, but avoid pasting production tokens into any online tool as a general security habit.

Common claims you'll see

  • iss (issuer) — who issued the token.
  • sub (subject) — the user or entity the token represents.
  • aud (audience) — who the token is intended for.
  • exp (expiration) — a Unix timestamp after which the token is no longer valid.
  • iat (issued at) — a Unix timestamp of when the token was created.

When present, exp and iat are automatically converted to human-readable dates below the decoded payload.

Want the full picture of how JWTs work — including why the payload isn't secret and what the signature actually protects? See Understanding JWTs: How JSON Web Tokens Work.

Frequently Asked Questions

No, and it deliberately doesn't try to. Verifying a signature requires the correct secret (HMAC) or public key (RSA/EC) and should happen in your backend or auth library, not in a public online tool.
Decoding happens 100% locally in your browser — the token is never transmitted anywhere. That said, treat tokens as sensitive credentials in general and avoid pasting production tokens into any third-party tool as a matter of habit.
A JWT must have exactly three dot-separated, Base64URL-encoded segments. Make sure you copied the entire token including all three parts, with no extra whitespace or line breaks.
If the payload includes an exp claim with a timestamp earlier than the current time, the tool flags the token as expired. Most APIs will reject an expired token even if its signature is otherwise valid.