JWT Decoder
Decode a JWT header and payload in your browser and check its expiry.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
JWT Decoder
How to use this tool
- Paste the full token — three base64url parts separated by dots.
- Click Run to read the header, the claims and the expiry status.
- Load the sample to decode a test token (its signature is not a real secret).
Worked example
The sample token decodes to header {"alg": "HS256", "typ": "JWT"} and payload {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}. Because it carries no exp claim, the tool reports “no expiry claim” rather than guessing a lifetime.
What this tool does not do / Limits
This tool decodes only — it does not verify the signature, because verification needs the signer's secret or public key, which you should never paste into a web page. Never paste a real production token here on a shared screen: its payload is readable by anyone who can see it, by design.
Frequently asked questions
Why does it say the signature is not verified?
Decoding reads the token; verifying proves who signed it. Without the secret or key there is nothing trustworthy to check against, so this tool states that plainly instead of showing a false green tick.
What if the payload looks garbled?
The token parts must be base64url without padding problems. A truncated token, extra whitespace or a missing dot will fail decoding — check you pasted all three parts.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live