All Developer

JWT Decoder

Decode a JWT header and payload, and optionally verify it.

jwt-decoder.local

Overview

Decodes a JSON Web Token (JWT) so you can read its header and payload in plain JSON. Built for developers debugging auth flows, inspecting claims, or checking expiry. Decoding happens in your browser, so you can paste real tokens without sending them to a server.

How it works

A JWT is three parts separated by dots: a header, a payload, and a signature, each Base64URL-encoded. The tool splits the token on the dots and Base64URL-decodes the header and payload back into readable JSON, then displays the claims. Important: a JWT is encoded, not encrypted. Anyone holding the token can read its payload, so it should never contain secrets. Decoding shows you what is inside the token; verifying is a separate step that checks the signature against a key. This tool decodes any token, and can also verify HS256 signatures if you supply the secret.

How to use it

  1. Paste your JWT into the input box.
  2. Read the decoded header and payload side by side.
  3. Check standard claims such as iss, sub, iat, and exp.
  4. Copy any field you need for debugging.

Examples

Checking why a session expired

Paste a token and read the exp (expiry) claim as a timestamp to confirm whether it has lapsed.

Inspecting custom claims

Decode a token from your API to verify it carries the roles or user id your backend expects.

FAQ

Is my token sent to a server?
No. Decoding runs entirely in your browser, so the token stays on your device. That makes it safe to inspect production tokens.
Does it verify the signature?
Yes, for HS256. Paste the secret and the tool checks the signature in your browser. For other algorithms it decodes and displays the contents without verifying. Either way, nothing is uploaded.
Can it decode an expired token?
Yes. Expiry does not affect decoding. You can read an expired token's claims, including the exp value that marks when it lapsed.
What do iat and exp mean?
They are standard claims: iat is the issued-at time and exp is the expiry time, both usually stored as Unix timestamps.
Is it safe to paste sensitive tokens?
Because nothing is uploaded, the token is not exposed by this tool. Still, treat any token as a credential and avoid sharing your screen while it is visible.

Related tools

Developer

JSON Formatter

Format, validate, beautify, and minify JSON.

Open tool
Developer

Base64 Encoder and Decoder

Encode text to Base64 or decode it back.

Open tool
Developer

Password Generator

Generate strong random passwords with length and character options.

Open tool
Developer

UUID Generator

Generate v4 UUIDs in bulk.

Open tool
Developer

URL Encoder and Decoder

URL-encode or decode percent-encoded strings.

Open tool

Embed this tool

Paste this snippet to put the tool on your own site. It runs entirely in the visitor's browser, the same as it does here.

<iframe src="https://tooldok.com/embed/jwt-decoder/" title="JWT Decoder by Tooldok" width="100%" height="560" style="border:1px solid #16130d;border-radius:16px;max-width:720px" loading="lazy"></iframe> <p style="font:13px sans-serif"><a href="https://tooldok.com/tools/jwt-decoder/" target="_blank" rel="noopener">JWT Decoder</a> by <a href="https://tooldok.com/" target="_blank" rel="noopener">Tooldok</a></p>