JWT Decoder & Debugger
Decode and inspect JSON Web Tokens — header, payload, and expiration.
How it works
JWTs are used everywhere in modern authentication — session tokens, API keys, SSO handoffs — but they're just Base64URL-encoded JSON, not encrypted. This tool splits a token into its header, payload, and signature, decodes the first two, and flags whether the exp claim has already passed.
- Paste an encoded JWT into the input field (or use the sample token to see how it works).
- Review the decoded header (algorithm, token type) and payload (claims) as formatted JSON.
- Check the expiration banner to see whether the token is still valid.
- Copy the header or payload JSON with one click for further inspection.
Common use cases
- Debugging why an API call is being rejected with a 401 by checking the exp or aud claim.
- Inspecting a third-party JWT (e.g. from an SSO provider) without writing a decoding script.
- Verifying that a backend is issuing tokens with the claims you expect during development.
- Checking token lifetime and expiry before wiring up refresh logic.
FAQ
- Does this verify the token's signature?
- No. This tool only decodes the header and payload — it doesn't validate the signature against a secret or public key, so a token that decodes successfully isn't necessarily authentic. Use a server-side library to verify signatures.
- Why does the payload show a token as expired?
- The expiration check compares the payload exp claim (a Unix timestamp) against the current time. If exp has already passed, the token is flagged as expired even though it still decodes fine.
- What happens to the token I paste in?
- See our Privacy Policy for details on how input data is handled.