JWT Decoder & Parser
Decodes a JWT so you can read the header, payload and signature sections directly.
Decode and parse JSON Web Tokens (JWT) online — inspect header, payload and registered claims at a glance.
Steps and notes
What is JWT Decoder & Parser — Inspect Header, Payload and Expiration?
A JWT (JSON Web Token) is three Base64URL segments joined by dots: header (algorithm and token type), payload (the claims, such as sub for the subject and exp for expiry) and signature. Decoding is pure Base64 — that is what this tool does — so anyone holding the token can read every claim inside it. That is fine and intended: JWTs carry identity, not secrecy. What decoding cannot tell you is authenticity — only the server holding the secret key or public key can verify the signature, and until it does, any decoded content should be treated as unverified input. Reading an expired token, checking which claims a third-party service actually issues, or debugging why your auth middleware rejects a token are the everyday jobs of this page.
- Paste the token
- Read the three decoded sections
- Check claims such as the expiry time
- This only decodes, it does not verify — you cannot tell from here whether the token was tampered with
- The payload is plain Base64, so never put sensitive data in it
Frequently asked questions
- Does decoding a JWT verify it?
- No. Decoding just reverses Base64URL and anyone can do it, including an attacker with a forged token. Verification requires the signing key (HMAC) or public key (RSA/ECDSA) on the server. A token whose signature you have not verified is a claim, not a fact.
- Is it safe to put user data in the JWT payload?
- Readable, yes; sensitive, no. The payload is plain Base64URL with no encryption — "decode" is one click. Never put passwords, keys, or data a user must not see into it; keep such data server-side and reference it by an identifier.
- My token was rejected — what should I check first?
- The exp claim first (this tool shows it; remember it is in seconds, not milliseconds), then that nothing mangled the token in transit — trailing whitespace, line breaks, or a proxy URL-decoding the Base64URL characters - and _ will all invalidate the signature.
Category: Web
JWT tools workflow
JWT Decoder & Parser — Inspect Header, Payload and Expiration → Base64 Encoder & Decoder — Padding, URL-Safe, Binary-Safe → Date Converter — Formats, Time Zones and ISO 8601 → Unix Timestamp Converter — Epoch to Date, Seconds vs Milliseconds