JWT Decoder
Decode and inspect JSON Web Tokens instantly
What a JWT carries
A JWT is how most modern auth systems carry identity in a string you can drop into an Authorization header, a cookie, or a URL. It is three base64url parts joined by dots: a header with the algorithm, a payload of claims, and a signature that proves the token was not altered. This tool decodes the first two parts so you can read what is inside.
Readable, not secret
The header and payload are base64-encoded JSON, not encryption, so anyone holding the token can read the claims: user ID, expiry, scopes, issuer. That is the design, since the server and often the client need to act on those claims. The protection lives in the signature, which the server recomputes with its secret key and checks. Without that key, nobody can forge a token that passes. This tool only decodes; it has no verify step, so a pasted signing key would do nothing.
The standard claims
The registered claims use short names: iss for issuer, sub for subject (usually the user ID), aud for audience, exp for expiry as a Unix timestamp, iat for issued-at, and nbf for not-before. The decoder turns the expiry into a readable date and flags whether the token has expired, while iat and nbf appear in the payload as raw Unix numbers. Custom claims such as role or email show up as they were written.
Quick answers
- Is it safe to paste my JWT here?
- The decode runs in your browser and fires no request, so the token stays local. Still, treat a live token like a password: anyone holding it can act as you until it expires, so do not share it with people you do not trust.
- Can I edit the payload and re-sign the token?
- Not here. Re-signing needs the secret key that only the issuing server holds. In a dev setup where you control that key, a command-line tool like jwt-cli can re-sign an edited token.
- Why does my token show an expiry in the past?
- It expired, which is what the exp claim is for. Auth servers hand out short-lived JWTs, often 15 minutes to an hour, and expect clients to refresh them, so request a fresh token.