About the JWT Decoder
Debug authentication by looking inside a JSON Web Token. Paste a JWT to see its decoded header and payload, plus human-readable issued-at (iat) and expiry (exp) times — all decoded locally in your browser, so tokens are never sent anywhere.
Frequently Asked Questions
How do I decode a JWT?
Paste the token; the header and payload are decoded instantly.
What is a JWT?
A JSON Web Token: a compact, signed token (header.payload.signature) used for login sessions and API authorization.
Does decoding verify the signature?
No, it only reads the contents. Verify signatures on your server with the secret or public key.
Is it safe to paste my JWT here?
Decoding happens in your browser and nothing is sent. Still, avoid sharing live production tokens anywhere.
How do I check when a JWT expires?
Look at the exp claim — it’s shown as a readable date and time.
Is a JWT encrypted?
Usually not — the payload is just Base64URL-encoded, so don’t put secrets in it.
What are iat, exp and sub?
Issued-at time, expiry time and subject (usually the user ID).
Why is my JWT invalid?
It must have three dot-separated parts; extra spaces or a “Bearer ” prefix can break decoding.
What algorithms do JWTs use?
Commonly HS256 (shared secret) or RS256/ES256 (public/private keys), shown in the header’s alg field.
Is the JWT Decoder free to use?
Yes.