JWT Decoder

Inspect the header and payload of a JSON Web Token.

Header
Payload
How to use the JWT decoder
  1. Paste a token into Token, or press Sample to try a made-up one.
  2. Read the decoded Header and Payload as formatted JSON, and copy either part.
  3. Check Dates: iat, nbf and exp are shown as readable dates, with a warning when the token has expired.
Example
The sample token's header is {"alg":"HS256","typ":"JWT"} and its payload is{"sub":"1234567890","name":"Ada Lovelace","iat":1700000000,"exp":1700003600}. Theexp claim is one hour after iat, 14 November 2023 at 23:13:20 UTC, so the decoder marks it as expired.
Frequently asked questions
What is inside a JWT?
A JSON Web Token has three Base64URL parts separated by dots: a header that names the signing algorithm, a payload of claims about the user or session, and a signature over the first two parts.
Does this tool verify the signature?
No. Decoding only shows what the token claims; anyone can create a token with any payload. Verify the signature with the issuer's key on your server before trusting it.
Is it safe to paste my token?
Decoding happens in your browser and the token is never sent anywhere. Still, treat production tokens like passwords and avoid pasting them into tools you do not trust.
Related tools