JWT Decoder
Paste a JSON Web Token to inspect its header, payload, and signature. Expiry is shown automatically when the exp claim is present.
Signature not verified
This tool only decodes (reads) the token — it does not verify the signature. Never trust unverified JWT data in production code.
About JSON Web Tokens
What is a JWT?
A JSON Web Token is a compact, URL-safe string used to transmit claims between two parties. It is widely used for authentication and API authorization. The token encodes data as Base64URL and is signed to prevent tampering.
Header
The first segment declares the token type (always "JWT") and the signing algorithm — for example HS256 or RS256. This section is Base64URL-encoded, not encrypted.
Payload
The second segment contains the claims: standard fields like sub, iat, and exp, plus any custom data. The payload is also Base64URL-encoded and is readable by anyone who holds the token.
Signature and verification
The third segment is the cryptographic signature. It proves the token was issued by a trusted party and has not been modified. Decoding a JWT does not verify its signature — always validate tokens server-side before trusting the claims.
How to use
- 1Paste your JWT
Copy your JWT token (the full eyJ... string) and paste it into the input field.
- 2View the decoded parts
The header, payload, and signature are decoded and displayed instantly as formatted JSON.
- 3Inspect the claims
Read the payload claims (sub, iat, exp, etc.) to understand what the token contains.
Frequently asked questions
What is a JWT?
JWT stands for JSON Web Token. It is a compact, URL-safe token format used to securely transmit claims between two parties. A JWT consists of three Base64URL-encoded parts separated by dots: header (algorithm and type), payload (claims), and signature (verification).
Does this tool verify the JWT signature?
No. Signature verification requires the secret key or public key used to sign the token, which the client does not have. This tool decodes and displays the contents of the token — use your backend or an authentication library for signature verification.
Is my JWT token safe to paste here?
Yes. The token is decoded entirely in your browser using JavaScript. It is never sent to any server. That said, JWTs may contain sensitive claims — use this tool in a private context and avoid pasting production tokens on shared screens.
What does "exp" mean in a JWT payload?
"exp" is the expiration claim — a Unix timestamp indicating when the token expires. Other common claims include "iat" (issued at), "sub" (subject/user ID), "iss" (issuer), and "aud" (audience). The exact claims depend on what your authentication system includes.
Why does the JWT start with "eyJ"?
"eyJ" is the Base64URL encoding of {" (the start of a JSON object). All JWTs begin with a Base64URL-encoded JSON header, so they always start with eyJ.