JWT Decoder

About JWT Decoder

A JSON Web Token looks like three random strings separated by dots, and that's exactly what it is: a header, a payload, and a signature, each Base64URL-encoded and joined with periods. Servers hand them out at login, and clients attach them to requests as proof of who you are. The catch that trips up beginners: everything in the first two parts is readable by anyone. A JWT is signed, not encrypted.

Paste a token and this decoder pretty-prints the header and payload as readable JSON, surfacing the algorithm and the expiry time automatically. That expiry line alone explains a huge share of mysterious 401 errors, tokens quietly go stale, and now you can see exactly when.

The signature is not verified here, and the tool says so plainly: decoding is not validating. Never trust a token's claims without server-side signature verification, and as a matter of hygiene avoid pasting live production tokens into any web tool. The habit of caution transfers everywhere.

How to use JWT Decoder

1. Paste the JWT into the input box.
2. Click Decode.
3. Read the header and payload; check the expiry line.

Why use this tool?

• Pretty-printed header and payload JSON
• Expiry and algorithm surfaced automatically
• Explicit unverified-signature warning

Tips for best results

• Check the exp claim first when debugging unexpected 401s, expired tokens are the most common cause.
• Decoding is not verification: a readable payload proves nothing about authenticity without checking the signature server-side.
• Treat the payload as public, never put passwords, keys, or sensitive personal data in a JWT's claims.
• An 'alg: none' header is a red flag; legitimate tokens specify a real signing algorithm like HS256 or RS256.
• If decoding fails, the token is likely truncated or missing a section, JWTs always have exactly three dot-separated parts.
• Avoid pasting production tokens into web tools as a habit, even ones that run locally like this one.

Frequently asked questions

Related tools