JWT Decoder
Paste a JWT to inspect its header and payload. We do not verify signatures — keep secrets private.
Header appears here
Payload appears here
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe token used to transmit claims between two parties. A JWT has three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims such as user ID and expiry), and the signature (used to verify the token was not tampered with).
JWTs are used in OAuth 2.0, OpenID Connect, and most modern REST APIs. This tool decodes and inspects the header and payload of any JWT.
How to decode a JWT online
- Paste your JWT (the three-part xxxxx.yyyyy.zzzzz string) into the Input box.
- The decoded Header and Payload appear as formatted JSON.
- The tool shows the expiry time in human-readable form and warns if the token is expired.
Frequently Asked Questions
Is it safe to paste a JWT into this tool?
This tool decodes only the header and payload, which are Base64URL-encoded, not encrypted. They are readable by anyone with the token. The signature is not verified here. Never share a JWT that grants access to a real account in a public tool.
What is the difference between HS256 and RS256?
HS256 (HMAC-SHA-256) uses a single shared secret key to both sign and verify tokens. RS256 (RSA-SHA-256) uses a private key to sign and a public key to verify, enabling third parties to verify tokens without the issuing secret.
What claims are in a JWT payload?
Standard claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), iat (issued at), and nbf (not before). Applications can also add custom private claims.
Does this tool verify the JWT signature?
No. Signature verification requires the secret key (for HS256) or the public key (for RS256). This tool only decodes the header and payload for inspection — it does not validate the token.
Why is my JWT showing as expired?
The exp claim in the payload is a Unix timestamp. If the current time is past that timestamp, the token is expired and should be rejected by the server.