JWT Decoder
Read a token's header, payload, and expiry. Decoding only, never sent.
Token
Output
Paste a token above to decode it.
More in this kitAll of Developer Utilities
About JWT Decoder
A JSON Web Token is three Base64URL segments joined by dots: a header, a payload of claims, and a signature. The JWT Decoder splits a token apart and shows the header and payload as readable JSON, along with whether the token has passed its expiry time.
How to use it
- Paste the full token, in the form header.payload.signature, into the input panel.
- Read the decoded header and payload in the output panels.
- Check the chip that shows whether the token is expired or still valid, based on its exp claim.
Good to know
- Decoding is not verification. This tool does not check the signature, so it cannot tell you whether a token is genuine or has been tampered with.
- Anyone holding a token can read its payload, which is why sensitive data should never be stored in one.
- The token is decoded locally and is never sent to a server, but treat live production tokens with care anyway.
Common questions
Does this verify the token signature?
No. Verifying a signature needs the secret or public key, which this tool never asks for. It only reads what is inside the token.
Why does it say my token is malformed?
A JWT must have exactly three dot-separated segments, and the first two must be valid Base64URL that decode to JSON. Check that the whole token was copied and that no line breaks crept in.