JWT Decoder
Read the claims and check the expiry
Input
The token is decoded in your browser and never transmitted.
Result
No token yet
Paste a JWT and its contents appear here.
A JWT looks opaque but its first two parts are only Base64 — the claims inside are readable by anyone holding the token. When an API returns 401, decoding the token usually shows immediately whether it expired or is missing a claim.
How to use
- 1 Paste the token.
- 2 The header and payload are decoded immediately.
- 3 Check the issued and expiry times, shown in your local timezone.
- 4 The signature is displayed but not verified — that needs the secret key.
Frequently asked questions
Is it safe to paste a token here?
The decoding happens entirely in your browser and nothing is transmitted. That said, a valid token is a live credential — treat it like a password and revoke it if you have pasted it anywhere you are unsure about.
Why can the signature not be verified?
Verification needs the secret or public key that signed the token, which only the issuing server has. Decoding shows you what the token claims; verification proves those claims were not altered.
Should I put sensitive data in a JWT?
No. The payload is encoded, not encrypted — anyone with the token can read every claim in it. Signing prevents tampering, not reading.