About JWT Decoder
The JWT Decoder lets you decode and inspect JSON Web Tokens (JWT) instantly. Paste any JWT and view the decoded header (algorithm, token type), payload (claims, expiry, issuer, subject, audience), and signature portion — all formatted as readable JSON.
Expiry times (exp) and issued-at times (iat) are converted from Unix timestamps to human-readable date and time. Claims are displayed with clear labels so you can quickly understand the token's purpose and validity period.
This tool does not verify the JWT signature — it only decodes the header and payload. No secret key is required.
All decoding happens entirely in your browser. Your JWT never leaves your device.
How to Use JWT Decoder
Paste your JWT token into the input field.
The header and payload are decoded and displayed as formatted JSON.
Expiry (exp) and issued-at (iat) times are shown as human-readable dates.
Review the claims and copy any values you need.
Examples
Frequently Asked Questions
Is my JWT sent to a server?
No — all decoding happens entirely in your browser using JavaScript. Your token never leaves your device.
Can this verify a JWT signature?
No — signature verification requires the secret key (for HMAC) or the public key (for RSA/ECDSA), which are not available to this tool. It decodes the header and payload only.
What are JWT claims?
Claims are statements about the subject of the token. Standard claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), iat (issued at), and jti (JWT ID). Custom claims are also common.
How do I check if a JWT is expired?
The exp claim contains a Unix timestamp. This tool converts it to a readable date and highlights it if the token is already expired.
What are the three parts of a JWT?
A JWT has three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims), and the signature.
What signing algorithms does JWT support?
Common algorithms include HS256, HS384, HS512 (HMAC-SHA), RS256, RS384, RS512 (RSA), and ES256, ES384, ES512 (ECDSA). The algorithm is declared in the header's 'alg' field.