JWT Decoder
Decode and inspect JWT (JSON Web Token) headers and payloads without verifying the signature.
Did this tool work for you?
How to use this calculator
- 1
Paste your JWT token into the text area.
- 2
The header and payload are decoded and displayed.
- 3
Expiry time is shown if the token includes an "exp" claim.
- 4
Important: this tool only decodes — it does NOT verify the signature.
Frequently asked questions
Is it safe to paste my JWT here?
All decoding happens in your browser — nothing is sent to a server. That said, JWTs can contain sensitive user data. Avoid pasting production tokens from live systems.
What is the difference between decoding and verifying a JWT?
Decoding reads the header and payload. Verifying checks the cryptographic signature to ensure the token was not tampered with. Only the server with the secret key can verify. This tool only decodes.
What are iat and exp claims?
"iat" (issued at) is the timestamp when the token was created. "exp" (expires) is when it stops being valid. Both are Unix timestamps (seconds since epoch).
JWT tokens: structure and contents
How to use the jwt decoder
Use this jwt decoder to decode and inspect jwt (json web token) headers and payloads without verifying the signature. Enter your values above and get your result in seconds. The tool is free, works on all devices, and keeps your data private — nothing is stored or shared.
How the jwt decoder works
The jwt decoder uses standard formulas used in software development, web development, and coding. Enter your inputs, and the tool calculates the result instantly in your browser. No server-side processing means your data stays on your device. Results update in real time as you change inputs.
JWT structure
A JWT has three Base64URL-encoded parts separated by dots: header.payload.signature. The header names the algorithm (HS256, RS256, etc.). The payload carries claims (user ID, roles, expiry). The signature proves the token was issued by a trusted party.
Common JWT claims
sub (subject): who the token is about (usually a user ID). iss (issuer): who created the token. exp (expiry): Unix timestamp after which the token is invalid. iat (issued at): creation time. nbf (not before): token is invalid before this time. Custom claims can carry roles, permissions, or any application data.
Jwt decoder: how it works
Developer utilities streamline debugging, encoding, formatting, and data validation tasks. This tool is designed for engineers who need reliable, fast results without switching between applications.
Who uses this tool?
Front-end developers, back-end engineers, security researchers, and DevOps professionals use it to inspect, encode, and transform data without leaving the browser — saving context switches and copy-paste errors.
Learn more from an authoritative source:
MDN Web DocsJSON Formatter & Validator
Format, validate, and minify JSON — with clear error messages for invalid input.
Base64 Encoder / Decoder
Encode plain text to Base64 or decode Base64 strings back to readable text.
URL Encoder / Decoder
Encode special characters in URLs (percent-encoding) or decode percent-encoded URLs.
UUID Generator
Generate UUID v4 (random) identifiers — one or in bulk.
Results are estimates for informational purposes only and do not constitute professional financial, medical, legal, or technical advice. Read full disclaimer →