What is a JWT (JSON Web Token)?

A JWT is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three Base64URL-encoded parts: a header, a payload, and a signature, separated by dots.

Is it safe to decode JWTs in the browser?

Yes. Decoding a JWT simply reads its contents — it does not validate or verify the signature. This tool processes everything in your browser, so your token never leaves your device.

Can this tool verify JWT signatures?

This tool decodes and displays the header, payload, and signature. It does not verify the signature because that requires the secret key or public key, which should remain private.

What do the common JWT claims mean?

Common claims include: 'sub' (subject/user ID), 'iat' (issued at timestamp), 'exp' (expiration timestamp), 'iss' (issuer), 'aud' (audience), and 'nbf' (not before). Custom claims can contain any application-specific data.

How do I check if a JWT is expired?

Paste your JWT into this tool and it will automatically check the 'exp' claim against the current time, showing whether the token is still valid or has expired, along with the remaining time.

JWT Decoder

Paste a JSON Web Token to decode and inspect its header, payload, and signature. Check token expiration status instantly. All processing happens in your browser — your token is never sent to any server.

JWT Token

What Is a JWT Decoder?

A JWT decoder extracts and displays the three parts of a JSON Web Token: the header (algorithm and type), the payload (claims and data), and the signature. JWTs are widely used for authentication and authorization in web applications and APIs.