JWT Decoder: Inspect Token Header & Payload
Decode a JWT's header and payload locally and read its claims and expiry. Decoding is not verification: your token never leaves the browser.
JWT Decoder tool
Decoding is not verification. This tool shows what a token claims. It does not check the signature, so it can't tell you whether a token is genuine or valid.
Your token is decoded in your browser and never sent anywhere.
About this tool
Decode a JSON Web Token to read its header and claims, with exp, iat and nbf shown as dates and relative times. Warnings flag expired tokens, tokens without an expiry and the dangerous alg "none".
Decoding is not verification: this tool never checks the signature, so it can't tell you whether a token is genuine. Your token never leaves your browser.
How to use it
- Paste a token (a leading "Bearer " is fine).
- Read the header, claims and time information.
- Copy the header or payload JSON if needed.
Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfMTIzIiwiZXhwIjoxNzM1NjkzMjAwfQ.…Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "usr_123", "exp": 1735693200 }
exp → 2025-01-01T01:00:00.000ZCommon use cases
401 and 403 debugging
Check whether a token has expired or is missing a scope or role claim.
Integration setup
Confirm the issuer, audience and claims an identity provider actually sends.
Code reviews
Spot unsigned (alg none) or never-expiring tokens.