A JSON Web Token (JWT) is a compact, URL-safe token used to represent claims between parties. It has three Base64URL-encoded parts: header, payload, and signature, separated by dots.
No. This tool only decodes the header and payload for inspection. Signature validation requires the secret key and should be done server-side.
Yes, for non-production tokens. Everything runs in your browser β your token is never sent to any server. For production tokens, be mindful of who might see your screen.
JWTs can include an 'exp' claim β a Unix timestamp after which the token should be rejected. This tool compares that timestamp to the current time and shows whether the token is still valid.
JWTs are self-contained tokens that carry claims (user ID, roles, expiry) inside them β no server lookup needed. API keys are opaque strings that require a database lookup to find the associated permissions. JWTs are stateless; API keys are stateful.
Access tokens: 15 minutes to 1 hour. Refresh tokens: days to weeks. Shorter lifetimes improve security (a stolen token expires quickly) but require more frequent re-authentication. The right balance depends on your application's security requirements.
Session cookies store only a session ID; the server holds the session data. JWTs store all data in the token itself β the server needs no storage. JWTs scale better across multiple servers but cannot be invalidated without extra infrastructure (a blocklist).
JSON Web Tokens are the standard authentication credential format for REST APIs and single-page apps. This tool decodes any JWT instantly β revealing the algorithm, claims, expiry, and issuer β without requiring a secret key or server-side processing.
Paste your JWT token
Copy a JWT from your browser's DevTools (Network tab β Authorization header), from a cookie, or from your app's response. It starts with 'eyJ' β paste the full string including all three dot-separated parts.
Inspect header and payload
The tool splits the token into header (algorithm, token type), payload (all claims), and signature sections. All fields are decoded from Base64URL and displayed as formatted JSON.
Check expiry and validity
The tool reads the 'exp' claim and compares it to the current time, showing whether your token is still valid or has expired. It also shows 'iat' (issued at) and 'nbf' (not before) if present.
Inspect custom claims
Beyond standard claims, look at your application's custom fields β user ID, roles, permissions, tenant ID β to debug authorization issues.
Debug authentication issues
When a user reports being logged out unexpectedly, grab their token from the Authorization header and decode it here to see exactly when it expires and what permissions it contains.
Inspect third-party tokens
OAuth providers (Google, GitHub, Auth0) return ID tokens as JWTs. Decode them to see the user's profile claims, email, and the token's issuer and audience.
Verify token structure during development
When building a new authentication service, paste generated tokens here to confirm they contain the right claims, use the correct algorithm, and have a sensible expiry time.
A JSON Web Token (JWT) is a compact, URL-safe token consisting of three Base64URL-encoded sections β header, payload, and signature β joined by dots. The header specifies the signing algorithm (HS256, RS256, etc.); the payload holds claims like user ID, roles, and expiration time; the signature allows the recipient to verify the token has not been tampered with. JWTs are widely used for stateless authentication in REST APIs and single-page applications.
This decoder lets you inspect JWT headers and payloads instantly in your browser without sending tokens to a third-party service β which matters because JWT payloads often contain sensitive claims like user IDs, email addresses, and roles. Paste any JWT to see the decoded header and payload, the signing algorithm used, and whether the token is expired based on the standard exp claim. All decoding runs locally; the token never leaves your device.