JWT Decoder
Decode and inspect JWT (JSON Web Token) headers and payloads without verifying the signature.
Did this tool work for you?
How to use this calculator
- 1
Paste your JWT token into the text area.
- 2
The header and payload are decoded and displayed.
- 3
Expiry time is shown if the token includes an "exp" claim.
- 4
Important: this tool only decodes — it does NOT verify the signature.
Frequently asked questions
Is it safe to paste my JWT here?
All decoding happens in your browser — nothing is sent to a server. That said, JWTs can contain sensitive user data. Avoid pasting production tokens from live systems.
What is the difference between decoding and verifying a JWT?
Decoding reads the header and payload. Verifying checks the cryptographic signature to ensure the token was not tampered with. Only the server with the secret key can verify. This tool only decodes.
What are iat and exp claims?
"iat" (issued at) is the timestamp when the token was created. "exp" (expires) is when it stops being valid. Both are Unix timestamps (seconds since epoch).
JWT tokens: structure and contents
JWT structure
A JWT has three Base64URL-encoded parts separated by dots: header.payload.signature. The header names the algorithm (HS256, RS256, etc.). The payload carries claims (user ID, roles, expiry). The signature proves the token was issued by a trusted party.
Common JWT claims
sub (subject): who the token is about (usually a user ID). iss (issuer): who created the token. exp (expiry): Unix timestamp after which the token is invalid. iat (issued at): creation time. nbf (not before): token is invalid before this time. Custom claims can carry roles, permissions, or any application data.
Learn more from an authoritative source:
MDN Web DocsCron Expression Generator
Generate and explain cron expressions — pick a preset or write your own.
Slug Generator
Convert any title or phrase into a clean URL slug — lowercase, hyphenated, SEO-friendly.
DNS Lookup
Look up any DNS record type (A, AAAA, MX, NS, CNAME, TXT, SOA) for any domain — powered by Cloudflare DNS.
MX Lookup
Check the mail exchange (MX) records for any domain to see which mail servers receive email for it.
NS Lookup
Find the authoritative nameservers (NS records) for any domain to see who controls its DNS.
CNAME Lookup
Check CNAME (canonical name) records for any domain to see where it is aliased to.
Results are estimates for informational purposes only and do not constitute professional financial, medical, legal, or technical advice. Read full disclaimer →