Loading...
Tool location: /dev/jwt-decode
Decode and inspect JSON Web Tokens (JWT) to view their header and payload contents. JWTs are used for authentication and authorization in modern web applications. This tool decodes tokens without verifying their signature.
Copy your JWT token and paste it into the input field. JWTs have three parts separated by dots: header.payload.signature
The decoded header shows the token type and signing algorithm (e.g., HS256, RS256). This tells you how the token was created.
The payload contains the claims - the actual data in the token. Common claims include:
The tool automatically checks if the token has expired by comparing the exp claim with the current time.
View complete header and payload contents.
Automatic check if token is expired.
Timestamps converted to readable dates.
Pretty-printed JSON for easy reading.
Important claims highlighted for quick inspection.
This tool does NOT verify signatures - do not trust decoded data for security decisions.
JWTs are only Base64 encoded, not encrypted - anyone can read the payload.
Never put sensitive data like passwords in JWT payloads.
An invalid or malformed JWT will show an error.
A: A JSON Web Token (JWT) is a compact, URL-safe token format used to securely transmit information between parties. It consists of three parts: header (algorithm info), payload (claims/data), and signature (verification).
A: Signature verification requires the secret key or public key used to sign the token. This client-side tool is for inspection only. Your server should verify signatures before trusting token contents.
A: The token exp (expiration) claim timestamp is in the past. The token should no longer be accepted. Generate a new token through your authentication flow.
A: You can modify the payload, but the signature will become invalid. JWTs are tamper-evident - any modification breaks the signature verification on the server.