JWT Decoder
Inspect JWT header and payload claims and check expiry
What is JWT Decoder?
A JWT decoder that splits a JSON Web Token into its three segments, shows the decoded header and payload, and renders timestamp claims such as iat and exp as readable dates. Decoding happens entirely in the browser and the token is never uploaded, so it is safe to inspect production tokens.
How to use JWT Decoder
- 1Paste the complete JWT, in the form xxxxx.yyyyy.zzzzz.
- 2Review the algorithm in the header and the claims in the payload.
- 3Check whether exp has already passed and whether iss and aud match what you expect.
- 4To verify the signature, do it on your backend with the secret — this page only decodes.
How do I do this in code?
Use the tool above for one-off work; for anything you repeat, move it into a script or your project.
// Decode only - this does not verify the signature
const decodePayload = (token) => {
const part = token.split('.')[1];
const json = atob(part.replace(/-/g, '+').replace(/_/g, '/'));
return JSON.parse(decodeURIComponent(escape(json)));
};Common errors and how to fix them
| Symptom | Cause | Fix |
|---|---|---|
| Decoding fails with an error about the number of segments | The signature segment was lost when copying, or the Bearer prefix was copied along with the token. | Strip the Bearer keyword and any whitespace, and confirm the string contains exactly two dots. |
| The exp claim resolves to a time in the past | The token has expired and the server will reject it with a 401. | Obtain a new token with the refresh token, or check whether the server and client clocks have drifted apart. |
Frequently asked questions
Is it safe to paste a JWT into this decoder?+
Decoding here runs entirely inside your browser with no upload request of any kind, so it is fine for debugging production tokens that carry sensitive claims. The general rule still applies though: never paste a long-lived, highly privileged token into an online tool whose implementation you have not verified.
Why can a JWT be decoded without the secret?+
The header and payload are only Base64URL encoded, not encrypted, so anyone holding the token can read them. The secret is used solely to produce and verify the third segment, the signature. That is precisely why sensitive data must never be placed in the payload.
Does this tool verify the signature?+
No. Verifying a signature requires the secret or public key, and neither belongs in a browser. Signature verification has to happen in your backend service; decoding on the client is only for reading claims and diagnosing expiry problems. A decoded token tells you nothing about whether it is authentic.
Related tools
All toolsBase64 Encoder & Decoder
Encode and decode Base64, with UTF-8 and URL-safe support
File to Base64
Convert files to Base64 and data URIs — nothing is uploaded
URL Encoder & Decoder
Percent-encode URLs, with separate modes for full URLs and parameter values
HTML Entity Encoder
Escape and unescape HTML entities
Hex to Text Converter
Convert between text and hex with several separator styles
Unicode Escape Converter
Escape and unescape Unicode in three notations