Token
Decode JWT headers, payload claims, and signatures for inspection.
Decoded
Payload Claims
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Ada Lovelace",
"admin": true,
"iat": 1717200000,
"exp": 1717203600
}Signature
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
About Token Decoder
Token Decoder decodes the three Base64URL-encoded segments of a JSON Web Token — the header, the payload claims, and the signature metadata — and displays them as readable JSON. Because the payload is only encoded and not encrypted, decoding requires no key. Use it to inspect the claims your auth server is issuing, check expiry timestamps, and debug OAuth and OIDC token flows without writing any code.
Common uses
- Inspect the claims inside a JWT — user ID, roles, expiry time — without writing any code.
- Verify that your auth server is issuing the correct payload before wiring up client-side guards.
- Check whether a token has expired by reading the exp claim and comparing it to the current time.
- Debug OAuth and OIDC flows by decoding the id_token or access_token returned by the provider.
Related tools
FAQ
What is a JWT token?
A JSON Web Token (JWT) is a compact, URL-safe string made of three Base64URL-encoded parts separated by dots: a header declaring the algorithm, a payload containing claims (user ID, roles, expiry time), and a signature. It is widely used in authentication flows so a server can verify a client's identity without querying a database on every request.
Is it safe to paste a JWT here?
The tool decodes the token entirely in your browser — nothing is sent to a server. That said, treat JWTs like passwords: avoid pasting production tokens into any tool you do not control, and rotate tokens if they have been shared beyond their intended audience.
Can this tool verify the JWT signature?
No. Verifying the signature requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms), which are not shared here. The tool decodes and displays the header and payload claims; signature verification must be done by your application with the appropriate key.
What does the exp claim mean?
The exp claim is the expiry time as a Unix timestamp (seconds since 1 January 1970 UTC). Compare it to the current Unix time — Date.now() / 1000 in JavaScript — to determine how long the token is valid for, or whether it has already expired.
Is Token Decoder free to use?
Yes — Token Decoder is completely free and requires no sign-up or account. There are no usage limits for standard decoder tasks.
Does Token Decoder send my data to a server?
No. Token Decoder runs entirely in your browser using JavaScript. Text you paste and files you upload never leave your machine, so it is safe to use with sensitive payloads, API tokens, and internal configuration data.