Decode a JWT Token
Inspect JWT headers, payload claims, and expiry dates instantly in your browser. Debug auth flows without exposing tokens to external servers.
Open JWT Decoder with a ready-to-run example.
- A login is failing and you need to inspect the token your API is receiving.
- You want to check whether a JWT has expired by reading the
expclaim. - You need to verify the
aud,iss, orroleclaims are correct before debugging further. - You received a token from a third-party OAuth provider and need to understand its structure.
- Paste the full JWT (all three dot-separated parts) into the JWT Decoder input.
- The tool immediately splits and Base64URL-decodes the header and payload.
- Check the
exp,iat,aud, andissfields in the decoded payload panel. - Optionally paste an HMAC secret to verify the signature (HS256/384/512).
- Decoding is not verification — anyone can decode a JWT. Signature verification confirms it was issued by a trusted party.
- The
expandiatvalues are Unix timestamps in seconds, not milliseconds. - If a token has three parts but the header or payload decodes to garbage, the token may be malformed or use a non-standard encoding.
- Never paste a live production token into any online tool. Use an expired token or a test token for debugging.
Admin user token with expiry
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDg2NDAwLCJhdWQiOiJhcGkuZXhhbXBsZS5jb20ifQ.signature
{"alg":"HS256","typ":"JWT"}
{
"sub": "user_123",
"role": "admin",
"iat": 1700000000,
"exp": 1700086400,
"aud": "api.example.com"
}
Service-to-service token with custom claims
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleS0wMDEifQ.eyJpc3MiOiJhdXRoLmludGVybmFsIiwic3ViIjoic3ZjLWJpbGxpbmciLCJhdWQiOlsicGF5bWVudHMuaW50ZXJuYWwiXSwic2NvcGUiOiJwYXltZW50czp3cml0ZSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDAzNjAwfQ.rs256-signature
{
"iss": "auth.internal",
"sub": "svc-billing",
"aud": ["payments.internal"],
"scope": "payments:write",
"iat": 1700000000,
"exp": 1700003600
}
A JSON Web Token is a compact, URL-safe format for transmitting signed claims between parties. It has three Base64URL-encoded parts: header (algorithm), payload (claims), and signature.
The decoder runs entirely in your browser — nothing is sent to a server. Still, best practice is to use expired or test tokens rather than live production credentials.
exp is a Unix timestamp (seconds since 1970-01-01T00:00:00Z) that marks when the token expires. The decoder shows this as a human-readable date and flags tokens that have already expired.
Decoding only Base64URL-decodes the header and payload — it does not check the signature. To verify, use the JWT & OAuth Security Toolkit which supports HS256/384/512 and RS256.
Privacy-first: runs locally in your browser. No uploads.