What is JWT Decoder?
Got a JWT token and want to know what is inside? Paste it here and we will break it into its three parts — Header, Payload, and Signature — each formatted as readable JSON. Great for debugging auth issues, checking when a token expires, or just understanding how JWTs work. Your token never leaves your browser.
▶Use Cases5 scenarios
- ◆Figuring out why an auth flow is failing
- ◆Checking what claims and expiry a token carries
- ◆Inspecting tokens returned by an API
- ◆Learning how JWTs are structured
- ◆Debugging "invalid token" errors
▶How to Use4 steps
- 1Paste your JWT (the long string with two dots)
- 2See Header, Payload, and Signature decoded instantly
- 3Check expiry dates and claims at a glance
- 4Copy any section you need
▶Features8 features
- ✓Free
- ✓No account needed
- ✓Runs in your browser
- ✓Handles common signing algorithms
- ✓Clean JSON output
- ✓Flags expired tokens
- ✓Nothing uploaded
- ✓Works on any device
▶FAQ6 questions
What is a JWT decoder?
A JWT decoder parses JSON Web Tokens, splitting them into Header, Payload, and Signature sections displayed as readable JSON. Input: JWT string (e.g., eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...). Output: decoded JSON objects. Used for debugging auth systems, checking token expiry, verifying signatures.
What are the three parts separated by dots?
Header (says which algorithm was used), Payload (the actual data and claims), and Signature (proves the token was not tampered with).
Is JWT encoding secure?
JWT is encoding, not encryption. Payload content can be viewed by anyone. Use JWE (JSON Web Encryption) for sensitive data protection.
Is my token uploaded?
No. All decoding happens locally in your browser. Tokens are never sent to any server.
Which signing algorithms are supported?
Supports HS256, HS384, HS512 (HMAC), RS256, RS384, RS512 (RSA), ES256, ES384 (ECDSA). The tool auto-detects algorithm type and verifies signatures.
How do I check if a token is expired?
The tool automatically parses the exp (expiration time) field in the Payload and compares it with the current time. Expired tokens show a red warning. Time format is Unix timestamp (seconds).