JWT Decoder
Decode the header and payload of a JSON Web Token and inspect its claims, including expiry when an exp claim is present. Be clear about what this is: decoding is not verification. The signature is never checked, the token is never sent anywhere, and a decoded token must never be treated as trusted.
JWT
Decoded
Header and payload will appear hereDecoding is not verification. A decoded token is not a trusted token, and nothing is sent anywhere.
How to use the JWT Decoder
- Paste the full token (three dot separated parts).
- Press Decode.
- Read the header and claims, and check the expiry line.
Example
An unsigned example token with sub, name, and exp claims.
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjMiLCJuYW1lIjoiQWRhIiwiZXhwIjoxNzY3MDAwMDAwfQ.
Frequently asked questions
Does this verify the signature?
No, and no online decoder should be trusted to. Verification needs the issuer key and belongs in your own backend.
Is the token sent to a server?
No. Base64url decoding happens in your browser tab only.