toolcubby
Home › URL tools › JWT Decoder

JWT Decoder

Paste a JSON Web Token to read its header and payload as clean, formatted JSON. This free JWT decoder reveals the algorithm, issuer, subject and expiry claims at a glance — decoded privately in your browser, with no signature verification and nothing uploaded.

What is a JWT decoder?

A JWT decoder is a tool that splits a JSON Web Token into its three parts — the header, the payload and the signature — and decodes the first two into readable JSON. A JWT is a compact way to securely pass claims between parties, commonly used for authentication and data exchange. Its structure is three base64url-encoded segments separated by dots, and the first two are just encoded JSON that anyone can read.

Decoding shows you what's inside, such as the signing algorithm in the header, and the claims in the payload like sub (subject), iat (issued at), exp (expiry) and iss (issuer). This lets developers and testers inspect tokens, debug authentication problems and understand what a server is receiving. Note that decoding does not verify the signature, so a decoded token's claims are not automatically trustworthy.

This tool runs entirely in your browser and never uploads the token you paste.

How to use the JWT decoder

  1. Paste your JSON Web Token into the input box.
  2. The header and payload are decoded automatically as formatted JSON.
  3. Read the claims, and check the expiry (exp) and issuer (iss) notes.

Example

Paste a typical token such as eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiaWF0IjoxNTE2MjM5MDIyfQ.xxxx and the tool shows a header with {"alg":"HS256"} and a payload with sub, iat and other claims, plus a note about whether the token has expired.

Common use cases

Pro tips

FAQ

What is a JWT?

A JSON Web Token is a compact, URL-safe way to represent claims between parties, with a header, a payload and a signature, separated by dots.

Does this tool verify the signature?

No. It only decodes and reads the header and payload. Verifying the signature requires the signing secret or public key.

What does the exp claim mean?

exp is the expiry time, given as a Unix timestamp. If it is in the past, the token has expired and should be rejected.

Is it safe to paste a real token here?

For real, production tokens they are not, because a token can contain sensitive data. Only test or clearly non-secret tokens should be pasted online.

Is it private?

Yes. Your token is decoded locally in your browser and nothing is uploaded or stored.

What is the difference between decode and verify?

Decoding just reads the base64url-encoded JSON. Verifying also checks the cryptographic signature to prove the token wasn't tampered with.

What is the header in a JWT?

The header names the signing algorithm, usually HS256 or RS256, and the token type, typically JWT.

Why does my decoded payload show numbers instead of text?

The iat and exp claims are Unix timestamps, so they appear as numbers. Convert them to a date to read the exact time.

Can I read a token without code?

Yes. This tool decodes the header and payload into readable JSON without you writing a single line of code.

Related searches

jwt decoder, decode jwt, json web token, what is a jwt, jwt hdrs payload, decode token online, jwt expiration, jwt claims, verify jwt, jwt without signature

Related tools