About the JWT Decoder
A JWT (JSON Web Token) is a compact, signed token — three Base64url parts separated by dots — used to carry authentication and authorization data between a client and server. Decoding one reveals its header and payload (the claims).
This decoder splits and Base64url-decodes the token in your browser so you can inspect the claims (issuer, subject, expiry, roles). It never uploads your token. Important: decoding is not verifying — anyone can read a JWT's contents; only the server with the secret can confirm it's authentic.
How to use the JWT Decoder
- 1Paste your JWT into the input.
- 2The header and payload are decoded and shown as readable JSON.
- 3Inspect the claims — especially `exp` (expiry), `iss` (issuer) and any roles.
Common uses
Debugging auth
See exactly what claims a token carries and whether it's expired.
Checking expiry
Read the `exp` claim to confirm a token is still valid.
Learning JWTs
Understand the header/payload/signature structure by example.
Frequently asked questions
Does decoding verify the token?
No. Decoding just reads the (unencrypted) header and payload. Verifying the signature requires the secret/public key and is done server-side.
Is a JWT encrypted?
Usually not — a standard JWT is signed, not encrypted. Its payload is only Base64-encoded, so never put secrets in a JWT payload.
Is my token sent anywhere?
No. Decoding happens entirely in your browser, which matters because tokens are sensitive credentials.
What does the `exp` claim mean?
It's the expiry time as a Unix timestamp. After that moment the token should be rejected by the server.