JWT Decoder

How to Use

1. Paste a JWT token (three Base64URL segments separated by dots).
2. The header and payload are decoded automatically and shown as formatted JSON.
3. If the payload includes an exp claim, the token's expiry status is shown.

How JWTs Work

A JSON Web Token (JWT) consists of three parts — header, payload, and signature — each Base64URL-encoded and joined with dots. The header and payload are plain JSON once decoded, but the signature requires the issuer's secret or private key to verify, which this tool does not have. This tool only decodes; it does not (and cannot) verify the signature.

Common Uses

• Inspecting the claims inside an access token while debugging an API integration.
• Checking when a token expires without writing code.
• Understanding what data an authentication provider embeds in its tokens.

Security note: never paste a token containing real secrets into a third-party tool in a production context. This tool processes the token on the server but does not store it.