JWT Decoder
Decode JWT tokens instantly — inspect header, payload, and signature. See algorithm, issued-at and expiration timestamps in human-readable format. All decoding happens in your browser, your tokens never leave your device.
Discover More Free Tools
How to Use This Tool
- Paste your JWT token into the input field.
- The header and payload are decoded automatically in real time.
- Review the algorithm (alg), token type (typ), and all claims.
- Check the issued-at and expiration timestamps — expired tokens are highlighted in red.
- Copy the decoded payload JSON with one click.
Related Tools
Base64 Encoder/Decoder
Encode text to Base64 and decode Base64 back to readable text. Works with standard Base64 and URL-safe variants. Quick way to embed data in URLs or decode API responses.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from any text. Also supports MD5 for legacy checks. Compare two hashes side by side to verify file integrity.
URL Encoder/Decoder
Encode special characters in URLs and decode percent-encoded strings back to normal text. Handles full URLs or individual components. Essential for working with query parameters and form data.
Frequently Asked Questions
What is a JWT token?
JWT (JSON Web Token) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64url-encoded parts: header (contains algorithm and token type), payload (contains claims like user ID, expiration, issuer), and signature (cryptographic signature to verify the token hasn't been tampered with).
Does this tool verify JWT signatures?
No. This tool decodes and displays the header, payload, and signature for inspection. It does not verify the cryptographic signature — that requires the secret key or public key, which should never be shared with an online tool. For signature verification, use a library in your backend code.
Is my JWT token sent to any server?
No. All decoding happens locally in your browser using JavaScript. Your token never leaves your device. This is important because JWT tokens often contain sensitive information like user IDs and permissions.
What is the difference between JWT and JWS?
JWT (JSON Web Token) is the data format. JWS (JSON Web Signature) is the signed version of a JWT. Most tokens you encounter are actually JWS — they include the cryptographic signature as the third part. An unsigned JWT has only two parts separated by a dot.
Why does the timestamp show a date in 1970?
JWT timestamps (iat, exp, nbf) are Unix timestamps in seconds. If a timestamp is 0 or very small, it corresponds to January 1, 1970 — the Unix epoch. This usually means the claim is missing or was set incorrectly by the token issuer.