About this tool
A JWT is a compact, Base64url-encoded token made of three parts — header, payload, and signature — commonly used for authentication and authorization in APIs. This tool splits a pasted JWT into its three components and decodes the header and payload back into readable JSON, so you can inspect claims like the subject, issuer, and expiration time without writing any code. It also converts the expiry (exp) claim into a human-readable date so you can quickly tell whether a token has already expired. Optionally, you can verify an HS256-signed token's signature against a known secret to confirm it hasn't been tampered with. Because JWTs often carry session or identity information, decoding happens entirely client-side — nothing is sent to a server.
Frequently asked questions
Is decoding a JWT the same as verifying it?
No — decoding just reads the Base64url-encoded header and payload, which anyone can do without a secret. Verifying checks the signature to confirm the token wasn't tampered with, which requires the signing secret or key.
Can this tool verify signatures?
Yes, for HS256-signed tokens, if you provide the shared secret. Verification for RSA/ECDSA-based algorithms typically requires a public key setup that goes beyond a simple shared secret.
Why does it say my token has expired?
The exp claim in the payload is a Unix timestamp; if it's earlier than the current time, the token is expired and most APIs will reject it even though it still decodes fine.
Is my token sent anywhere when I paste it?
No — decoding and optional verification both happen locally in your browser using JavaScript; the token never leaves your machine.
What's in the JWT header versus the payload?
The header typically specifies the signing algorithm and token type, while the payload contains the actual claims — user ID, expiration, issuer, and any custom data the issuer included.