JWT Decoder
Decode JSON Web Tokens instantly. Inspect header and payload, verify expiry (exp), issued-at (iat), and copy claims. Signature is not verified — tokens never leave your browser.
JWT input
Client-side only. Signature is shown, not verified.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload — checking expiry…
{
"sub": "1234567890",
"name": "Ada",
"exp": 2000000000,
"iat": 1700000000
}How to use
- Paste the token (header.payload.signature) in JWT input.
- Read Header and Payload panels plus expiry and issued-at status.
- Copy the claims you need.
FAQ
Is the signature verified?
No. This is a decoder/inspector, not a verifier. Always verify signatures server-side with your secret or JWKS.
Is pasting a JWT safe here?
Decoding is fully client-side, but JWTs can contain sensitive data. Prefer test tokens on shared machines.