JWT Decoder
Decode a JSON Web Token's header and payload — no signature verification.
Paste a JWT above to decode its header and payload.
What is JWT Decoder?
A JWT (JSON Web Token), defined in RFC 7519, is a compact, URL-safe token used to represent claims between two parties, most commonly for authentication and authorization after a user signs in. It is structured as three Base64URL-encoded parts separated by dots — header, payload, and signature — where the header and payload are plain JSON that anyone holding the token can read. This tool decodes the header and payload and pretty-prints them, and flags whether the token's optional exp (expiration) claim has already passed. It does not verify the signature, which requires the issuer's secret or public key and must be done server-side, so a decoded token's claims should never be treated as trustworthy until verified.
How to Use JWT Decoder
- Paste a JWT (a string with three dot-separated parts) into the input box.
- The header and payload are decoded and pretty-printed instantly — no data ever leaves your browser.
- Check the "Expires" line to see if the token's exp claim has already passed.
- Click "Copy" on either the header or payload panel to copy just that JSON object.
Examples
Decode a token
Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzAwMDAzNjAwfQ.fakesignature
Output: {"sub":"1234567890","name":"Ada Lovelace","iat":1700000000,"exp":1700003600}
Malformed token (not 3 segments)
Input: not.a.valid.jwt.token
Output: A JWT must have exactly three dot-separated segments.
Common Mistakes
- Trusting a decoded token's claims (like a user ID or role) without the server verifying the signature first — decoding is not the same as verifying.
- Storing a JWT in localStorage instead of an httpOnly cookie, which exposes it to any XSS vulnerability on the page.
- Not checking the exp claim before treating a token as still valid — an expired token decodes just fine, it just shouldn't be honored anymore.
- Assuming a JWT is encrypted — it's only Base64URL-encoded and signed, so anyone holding the token can read its payload.
Why Use This Tool
- Decodes header and payload instantly, entirely client-side — the token never leaves your browser.
- Flags whether the token is already expired based on its exp claim, so you don't have to do the math by hand.
- Pretty-prints both JSON objects for readability, with one-click copy for each.
- Clear, specific error messages for malformed tokens instead of a generic parse failure.