How to use
01
Paste your token
Drop the full JWT into the input box, all three dot-separated segments. The header and payload decode instantly as you type, no button needed.
02
Read the header and payload
The Header section shows the signing algorithm and token type, while the Payload section lists every claim. Each section has its own copy button for grabbing the JSON.
03
Check the expiry alert
If the payload contains an exp claim, the tool converts it to a readable date and shows a warning banner when the token has already expired.
Why JWT Decoder
- 100% client-side. Your tokens never leave your browser.
- Reveals header, payload, and signature parts.
- Highlights expired tokens via the exp claim.
Common questions
Does this JWT decoder verify the signature?
No, it only decodes. Verifying a signature requires the secret or public key the server signed with, so verification belongs in a server-side library. The third segment is displayed but never validated here.
Is it safe to paste a real token into this page?
Yes. Decoding happens with JavaScript in your browser, and the token is never transmitted or stored. Still, treat production tokens like passwords and rotate any you've shared in chat or a bug report.
Why does my token fail to decode?
The most common cause is a partial paste. A JWT needs at least two dot-separated parts, and each part must be valid base64url. Whitespace or a trailing quote copied from a log line will also break parsing.
What do the exp and iat claims actually mean?
Both are Unix timestamps in seconds. iat records when the token was issued and exp marks the moment it stops being valid. This jwt token viewer converts exp to a readable date so you don't have to do the math.
Can I decode a JWT that's missing its signature?
Yes. The tool only needs the header and payload segments, so a token with two parts still decodes. That helps when a logging pipeline has truncated the signature.
How is a jwt parser online different from decoding in code?
It's the same base64url decoding you'd do with a library, just with zero setup. For quick debugging a browser tool is faster; for anything automated, use a maintained JWT library in your language.
Will editing the decoded payload change my token?
No. Decoding is read-only, and changing a claim would invalidate the signature anyway. If you need a token with different claims, request a fresh one from the issuing server.