What is JWT Decoder?

JWT Decoder is a tool for pasting a JWT (JSON Web Token) and inspecting its header and payload. It fits token checks during API development or login debugging.

The token is decoded automatically and the header and payload appear as JSON. When expiry, issued-at, or not-before claims are present, they can also be read as dates. Everything runs in the browser, so tokens never leave your machine.

How to Use

1. Paste a JWT into the input field.
2. Review the decoded header and payload.
3. If an error appears, check that the three parts are joined by dots and that no extra characters slipped in.

Use Cases

• Checking user info or permissions inside a JWT returned by an API
• Narrowing down a login failure suspected to be an expired token
• Confirming that exp and custom claims hold the expected values

Input and Output Example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMiwiZXhwIjoxODkzNDU2MDAwfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

A token like this decodes into the following header and payload. Tokens carrying an expiry also show the date and whether it has expired.

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iat": 1516239022,
  "exp": 1893456000
}

Things to Keep in Mind

• This tool inspects token contents. It does not validate the signature
• Payloads are encoded rather than encrypted, so handle tokens carrying sensitive data with care