JWT Decoder
Decode and inspect JSON Web Tokens securely without sending them to a server.
About JWT Decoder
The JWT Decoder splits a JSON Web Token into its Header and Payload and displays both as formatted JSON, so you can inspect claims like expiry, issuer and roles without writing any code.
The header commonly identifies the token type and signing algorithm, while the payload carries registered claims such as `exp`, `iat`, `iss`, `aud` and application-specific authorization data. Reading these sections helps diagnose malformed claims, clock issues and unexpected role values.
Decoding is plain Base64Url parsing done in your browser — no backend involved.
How JWT Decoder works in practice
- 1Paste your JWT string into the input area.
- 2The Header and Payload are decoded and displayed instantly as formatted JSON.
- 3Review the claims to verify the token is structured as expected.
Jobs this tool is built for
- Inspect an `exp` claim while diagnosing why a session appears to expire early.
- Compare issuer and audience claims with an API gateway or identity-provider configuration.
- Check whether expected roles or scopes are present before debugging authorization code.
- Confirm that an application emitted valid JSON in both token segments during local development.
What you can do here
- Real-time decoding as you paste
- Formatted, readable Header and Payload JSON
- Fully client-side — the token never leaves your device
Limits and honest caveats
- Decoding a JWT only reads its contents — it does not verify the signature. A decoded token is not proof that the token is valid or trusted.
- JWT payloads are Base64Url-encoded, not encrypted, so never store passwords or sensitive secrets inside a token.
- Decoding happens locally in your browser; your token is never sent to our servers. Even so, avoid pasting live production tokens into any online tool.
Common questions about JWT Decoder
Can this tool verify the JWT signature?
No — it only decodes the contents. Signature verification requires the signing secret or public key and belongs on your application server.
Can someone read a JWT without the secret key?
Yes. Header and payload segments are encoded, not encrypted. The key is needed to verify or create a valid signature, not to read ordinary claims.
What do `exp` and `iat` mean?
`exp` is the expiry time and `iat` is the issued-at time, normally expressed as Unix seconds. Applications must still enforce these claims during verification.
Why does a token fail even though it decodes correctly?
Correct structure does not prove validity. The signature may be wrong, the token may be expired, or issuer, audience and algorithm policies may reject it.
This page was written by the ToolSink team to explain how JWT Decoder works on this site — it is not syndicated, scraped, or spun from another publisher. How we write tool guides · Site updates · About ToolSink.
All Developer Tools
Tap any tool to jump straight in — no signup, works on mobile.