A JSON Web Token (JWT) is a compact, URL-safe format for transmitting claims between parties. It consists of a Base64URL-encoded header, payload, and signature separated by dots (.).

Can this tool verify JWT signatures?

No. This decoder only shows the decoded contents of the token. Signature verification requires the secret or public key used to sign the token, which should be done server-side.

What does "exp" mean in a JWT payload?

"exp" is the expiration claim — a Unix timestamp after which the token is considered invalid. The decoder shows this as a human-readable date so you can quickly tell if the token has expired.

What does "iat" mean in a JWT?

"iat" (issued at) is a Unix timestamp recording when the token was created. It is useful for debugging token age and understanding token lifetime.

Why are there three parts in a JWT?

A JWT has three sections: the header (algorithm and token type), the payload (claims), and the signature (used to verify the token was not tampered with). They are separated by dots (.).

Is it safe to paste my JWT into this decoder?

The decoding happens in your browser. Avoid pasting tokens from live production sessions or tokens with sensitive access scopes — especially on shared or public devices.

JWT Decoder — Inspect JWT Header, Payload & Claims Online

DevTool House

Loading…

JWT decoder

About JWT Decoder

Paste a JSON Web Token and instantly inspect its header, payload claims, issued-at timestamp, and expiration — all decoded in the browser without sending your token to a server.

Last reviewed

June 23, 2026

Key Features

Decodes header, payload, and signature parts
Shows expiration (exp) and issued-at (iat) as human-readable dates
Displays all claim names and values clearly
Processes entirely in the browser for privacy
Useful for API debugging and token inspection

How to Use JWT Decoder

1Paste your JWT token into the input field.
2The decoder splits and decodes the three parts automatically.
3Review the header (algorithm, token type), payload (claims, expiry), and metadata.
4Check claim values or expiration before using the token in your workflow.

API 401 Unauthorized debugging example

When an API returns 401 Unauthorized, paste the JWT from your request to confirm the token has not expired, the audience (aud) claim matches the API endpoint, and the issuer (iss) is what the server expects.

How It Works

JWT tokens contain three Base64URL-encoded sections separated by dots. The decoder splits the token, decodes each section, and parses the JSON. The signature section is displayed but not cryptographically verified.

Privacy Notes

The token is decoded entirely in the browser. However, avoid pasting production tokens from live sessions or tokens that grant access to sensitive resources — especially in shared environments.

Limitations

The tool decodes and displays claims but does not verify the signature against a public key or secret. Never trust a decoded token for authentication or authorization decisions without proper server-side signature verification.

Frequently Asked Questions

JWT decoder

About JWT Decoder

Paste a JSON Web Token and instantly inspect its header, payload claims, issued-at timestamp, and expiration — all decoded in the browser without sending your token to a server.

Last reviewed

June 23, 2026

Key Features

Decodes header, payload, and signature parts
Shows expiration (exp) and issued-at (iat) as human-readable dates
Displays all claim names and values clearly
Processes entirely in the browser for privacy
Useful for API debugging and token inspection

How to Use JWT Decoder

1Paste your JWT token into the input field.
2The decoder splits and decodes the three parts automatically.
3Review the header (algorithm, token type), payload (claims, expiry), and metadata.
4Check claim values or expiration before using the token in your workflow.

API 401 Unauthorized debugging example

How It Works

Privacy Notes

The token is decoded entirely in the browser. However, avoid pasting production tokens from live sessions or tokens that grant access to sensitive resources — especially in shared environments.

JWT Decoder

About JWT Decoder

Key Features

How to Use JWT Decoder

API 401 Unauthorized debugging example

How It Works

Privacy Notes

Limitations

Frequently Asked Questions

1What is a JWT?

2Can this tool verify JWT signatures?

3What does "exp" mean in a JWT payload?

4What does "iat" mean in a JWT?

5Why are there three parts in a JWT?

6Is it safe to paste my JWT into this decoder?

JWT Decoder

About JWT Decoder

Key Features

How to Use JWT Decoder

API 401 Unauthorized debugging example

How It Works

Privacy Notes

Limitations

Frequently Asked Questions

1What is a JWT?

2Can this tool verify JWT signatures?

3What does "exp" mean in a JWT payload?

4What does "iat" mean in a JWT?

5Why are there three parts in a JWT?

6Is it safe to paste my JWT into this decoder?