JWT Decoder
Decode a JWT's header and payload and check its expiry.
What is the JWT Decoder?
A JWT (JSON Web Token) is made of three dot-separated parts: header.payload.signature. This decoder takes the first two parts, the header and payload, decodes them from Base64URL, and pretty-prints them as readable JSON. It is handy for quickly checking which claims a login token carries and when it expires (the exp claim).
Importantly, this tool only decodes the token; it does not verify the signature. Base64URL is an encoding, not encryption, so anyone can read the payload. This tool simply shows you that content; it does not check whether the signature is valid, i.e. whether the token has been tampered with. Signature verification requires a secret or public key and must always be performed on the server.
The token you paste is parsed entirely inside your browser and is never sent to a server. JWTs often carry sensitive data such as user IDs, roles, and email addresses, and since this tool sends none of those values anywhere, it is safe to paste a real production token.
How to use
- Paste the full JWT string, which starts with something like eyJhbGciOi..., into the input box.
- The header and payload are each shown as formatted JSON. Use the copy button on each section to place its contents on your clipboard.
- If the payload contains an exp claim, the expiration time and current status (expired or valid) are shown as well. If the format is invalid, an error message appears.
Frequently asked questions
- Does this tool verify the signature?
- No. It only decodes; it does not verify the signature. Verification needs the secret key (for HMAC) or public key (for RSA/ECDSA) used when the token was issued, and because it determines whether the token was tampered with, it must run on the server rather than in the client.
- If anyone can read the payload, isn't that a risk?
- A JWT payload is only Base64URL-encoded, not encrypted, so anyone can decode and read it. That is why you must never put secrets like passwords or credit-card numbers in the payload. The signature guarantees the token's integrity, not the confidentiality of its contents.
- How is the expiration (exp) status calculated?
- The payload's exp value is a Unix timestamp in seconds. The tool multiplies it by 1000 and compares it to the current time (Date.now()): if it has already passed it shows 'expired', otherwise 'valid'. The displayed expiration time uses your browser's local timezone.
- Why do I get a 'not a valid JWT format' error?
- A JWT must have at least two dot-separated parts (header.payload). If there is no dot or only one part, you get a format error. If Base64URL decoding or JSON parsing fails, you'll see a 'decode failed' message, so check that the token wasn't truncated.