JWT Decoder & Token Inspector

Decode JSON Web Tokens (JWT) into readable header, payload claims, and human-readable expiration dates — without transmitting your secret keys over the web.

Paste a JSON Web Token to decode its header and payload. Decoding is done entirely in your browser — nothing is sent to any server.

HEADER
{
  "alg": "HS256",
  "typ": "JWT"
}
PAYLOAD
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}
TIMESTAMPS
Issued at (iat)Jan 18, 2018, 01:30 AM
🔒 Signature: SflKxwRJSMeKKF2QT4fw... — The signature can only be verified server-side with the secret key.

Common Use Cases for JWT Decoder & Token Inspector

Debug Authentication Tokens

Check user roles, scopes, email claims, and permissions stored in OAuth/OpenID Connect tokens.

Verify Expiration Timestamps

Inspect "exp", "iat", and "nbf" unix timestamps converted to your local timezone.

Frequently Asked Questions

Is it safe to paste production JWTs here?

Yes, decoding is 100% client-side. The token string is never transmitted across the network.

Does this verify the cryptographic signature?

This tool inspects and decodes the token payload. Signature verification requires your private/public key on your backend.