JWT Decoder — Inspect JSON Web Tokens Online
JSON Web Tokens (JWT) are the backbone of modern web authentication. Used by virtually every REST API, OAuth 2.0 provider, and identity platform, JWTs carry verified claims between client and server in a compact, self-contained format.
Our JWT Decoder instantly decodes any JWT token to reveal its header, payload claims, and signature block. Expired tokens are flagged immediately. All timestamps (exp, iat, nbf) are converted to human-readable dates. 100% client-side — your tokens never touch our servers.
JWT Structure
A JWT has three parts separated by dots (.):
.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0 ← Payload (Base64URL)
.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c ← Signature
Last Updated: April 2026
Frequently Asked Questions
JWT (JSON Web Token) is a compact, URL-safe token standard (RFC 7519) used to securely transmit information as a JSON object. The information is verifiable because it is digitally signed — either using a secret (HMAC) or a public/private key pair (RSA or ECDSA). JWTs are used for authentication, authorization, and information exchange.
Standard JWT claims include: sub (subject — user ID), iss (issuer), aud (audience), exp (expiration time), iat (issued at), nbf (not before), jti (JWT ID). Applications also add custom claims like roles, permissions, email, and name. All payload claims are visible in the decoded output.
No — and intentionally so. Signature verification requires your secret key or RSA/EC public key, which should never be entered into any online tool. This decoder shows the decoded content only. Verify signatures server-side using your language's JWT library.
Decoding happens 100% in your browser using JavaScript — no network requests are made. Your token is never sent to any server. That said, avoid pasting real production tokens into any online tool as a security best practice. Use test tokens for debugging.
The exp (expiration) claim contains a Unix timestamp. If the current time is past that timestamp, the token is expired and will be rejected by servers. Our decoder highlights expired tokens with a warning badge. You'll need to obtain a fresh token from your authentication provider.