A JSON Web Token (JWT) is a compact, URL-safe token used to transmit claims between two parties. It has three parts separated by dots: header, payload, and signature.

Is it safe to paste my JWT here?

Yes. Decoding happens entirely in your browser — the token is never sent to any server. However, treat JWTs like passwords — don't share production tokens publicly.

Can this tool verify the signature?

This tool decodes and displays the token contents. Signature verification requires the signing key which is only available server-side.

Why is my token expired?

Check the 'exp' field in the payload — it's a Unix timestamp. If it's in the past, the token has expired.

JWT Decoder

Decode JWT tokens and inspect the header, payload and signature. Free online JWT decoder.

Frequently asked questions

JWT Decoder — Decode JSON Web Tokens Online Free

Paste a JWT and instantly see the decoded header and payload as formatted JSON. Check expiration dates, issuers, scopes, and all claims. Useful for debugging authentication flows and API integrations.

Instant decode

Paste a JWT and see the header and payload instantly — no button needed.

Expiration check

Automatically shows whether the token is expired or still valid.

Private

Decoding is pure base64 in your browser. No server involved.