JWT Decoder
Decode and inspect JWT header, payload and signature without a secret.
The result will appear here.
Was this tool useful?
About this tool
A JSON Web Token (JWT) is a compact, URL-safe token used to transfer claims between two parties. It has three Base64url-encoded sections separated by dots: the header (algorithm), the payload (claims) and the signature.
This decoder extracts the header and payload so you can read the claims — expiry, issuer, subject, roles and any custom data — without needing the secret key. It cannot verify the signature, which requires the private key or shared secret used by the issuing server.
How to use it
- Paste the JWT (the long string starting with 'ey').
- The header and payload are decoded automatically.
- Check the 'exp' claim to see when the token expires.
- Avoid pasting production tokens into untrusted tools.
Common problems
- The decoder shows 'Invalid JWT format'.
- A valid JWT has exactly three sections separated by periods. Check that you copied the full token without cutting any characters.