Browser-onlyNo upload
JWT Decoder
Inspect JWT headers and payloads locally without validating or uploading tokens.
About the JWT Decoder
A JSON Web Token (JWT) has three parts separated by dots: a header, a payload of claims, and a signature. The JWT Decoder decodes the header and payload so you can read claims such as the user, the issuer and the expiry time.
It does not verify the signature, so it cannot tell you whether a token is genuine. Everything runs in your browser with JavaScript. Nothing you type is uploaded to our server, so it is safe to use with private data. Even so, avoid pasting live production tokens into any website.
How to use it
- Paste the token.
- Select Decode token.
- Read the decoded header and payload.
Common uses
- Checking why a login session expired.
- Inspecting which claims and scopes an identity provider issues.
- Debugging authentication during development.
Tips
- The exp and iat claims are Unix timestamps; convert them with the Timestamp Converter.
- Anyone can read a JWT payload, so tokens should never contain secrets.