Paste a JWT to decode it.
Header
Payload
Signature
Decode a JSON Web Token in your browser. See the header, payload claims and signature with expiry highlighted. Runs entirely in your browser.
How it works
A JWT has three dot-separated parts — header, payload and signature — each base64url-encoded. Decoding just reverses the encoding; no key is needed to read a token.
- Header — the algorithm and token type, usually
alg: HS256andtyp: JWT. - Payload — the claims: subject, issuer, issued-at (
iat), not-before (nbf) and expiry (exp), plus any custom fields. - Signature — shown as hex. It proves the token was signed with the right key, but you can't verify it here without that key.
If the payload has an exp claim we compare it with your device clock and flag the token as expired or valid.
Frequently asked questions
Can I verify the signature here?
No. Verifying a signature requires the secret or public key the issuer used, and this tool is for reading tokens — debugging, inspecting claims, checking expiry.
Is it safe to paste a live token?
The token is decoded locally and only synced to the page URL so you can share the exact state. Treat any URL containing a live token as sensitive — anyone with the link can read the same claims.
Why does my token show as expired?
The exp claim is compared against your device clock. If your clock is ahead of the issuer's, a fresh token can look expired. Check your system time first.
What about the third part?
The signature is raw bytes, not JSON, so we show it as a hex string. For unsecured tokens (alg: none) the third part is empty and nothing is shown.