Helpful Toolbox

JWT Decoder

Peek inside a JWT to read its header and payload — your token never leaves the page.

📖 How it works & FAQ

Header



Payload

  


  


  


What a JWT actually contains


A JSON Web Token is the string you often see after logging into an API or web app, usually starting with eyJ. It's really three Base64URL-encoded parts joined by dots: the header, the payload, and the signature. This tool splits the token on those dots and decodes the first two parts back into readable JSON so you can see exactly what claims a token is carrying.


When you'd reach for this


Mostly when something isn't working and you need to look inside the token. Common moments: an API keeps returning 401 and you want to check whether the token has already expired, you're debugging a single sign-on flow and need to confirm the iss (issuer) and aud (audience) match what your server expects, or you're checking that a user's roles or scopes landed in the payload. Handy claims to know: exp and iat are Unix timestamps (seconds since 1970), sub is the subject, and alg in the header tells you the signing algorithm, like HS256 or RS256.


What decoding does and doesn't do


Decoding is not the same as verifying. The header and payload are only encoded, not encrypted, so anyone with the token can read them — which is exactly why you should never put passwords or secrets in a payload. The signature is what proves the token wasn't tampered with, and checking it needs the issuer's secret or public key. This tool shows you the contents; it does not validate the signature or trust the token.


How to use it


    
  
  1. Copy your token and paste the whole string into the input box.
    2. 
  
  2. The header and payload decode instantly into formatted JSON below.
    3. 
  
  3. Read the claims — check exp against the current time to see if it's expired, and confirm iss, aud, and any roles look right.
    4. 
  
  4. Clear the box when you're done so the token isn't left on screen.
    5. 



FAQ



  
Is it safe to paste a real token here?

  
Yes. Decoding happens entirely in your browser — the token is never uploaded or sent to any server. That said, treat live tokens as passwords and clear the field afterward.

  
Why can't I see the signature contents?

  
The signature is a cryptographic hash, not readable data. It exists to verify the token, and verifying it requires the signing key, which a decoder doesn't have.

  
My exp is just a big number. How do I read it?

  
It's a Unix timestamp in seconds. If it's smaller than the current time in seconds, the token has expired. Multiply by 1000 to compare it in most date tools.

  
Is this free?

  
Yes, it's completely free and supported by ads on the page.