JWT Decoder
Decode JWT headers, payloads and common claims instantly in your browser.
JWT decoder
Common JWT claims
What is a JWT decoder?
A JSON Web Token contains Base64URL-encoded header and payload sections. This tool makes
those sections readable and converts standard time claims such as exp,
nbf and iat into human-readable dates.
JWT contents are encoded, not encrypted. Avoid placing secrets in a token payload, and remember that decoding alone cannot detect a forged or modified token.
How to read JWT claims safely
JWT payloads often include claims such as subject, issuer, audience, expiration time and custom application permissions. Decoding those values can help during debugging when a login flow, API request or integration test is failing.
The header usually describes the token type and signing algorithm. The payload describes the claims. The signature is what a trusted server uses to prove the token was issued by the expected authority and has not been modified.
Why can an expired token still decode?
Decoding only reads text from the token. Expiration is a validation rule that must be enforced by the receiving application. A token can be readable and still be expired, invalid or rejected by an API.
Should I paste production tokens into online tools?
Avoid sharing real production tokens with any online service. This page decodes in your browser, but the safest workflow is still to use short-lived test tokens with non-sensitive claims.