JWT Decoder Online
Inspect the JSON header and payload of a three-part JWT. Read claims such as subject and expiry without confusing decoded data with a verified identity.
- Decode JWT header and payload JSON
- Read Base64URL token segments
- Keep signature verification explicitly separate
Paste a three-part token
The expected form is header.payload.signature. The first two segments are decoded into JSON for inspection.
Read claims as untrusted data
Anyone can construct a token with convincing-looking claims. A decoded role or subject is not evidence that the token is authentic.
Check expiry in the proper context
An exp value describes a claimed expiry time. Your application must validate the signature, issuer, audience and timing with trusted configuration.
Handle tokens as credentials
Real bearer tokens can grant access. Avoid sharing them in screenshots or logs, and clear the page after inspecting sensitive examples.
JWT Decoder FAQs
No. This decoder does not verify signatures or authorize access.
No. Encrypted tokens use a different structure and require keys and a JWE implementation.
Decode the payload and copy the exp value into Unix Timestamp Converter with seconds selected. That reveals the claimed expiry time. Your application must still validate the token signature, issuer, audience and timing; decoding a claim does not establish that it is trustworthy.