Decode and inspect JWT tokens. View header and payload as formatted JSON, check expiration time, and see if the token is expired. All decoding happens in your browser—no tokens are stored or transmitted.
JSON Web Tokens (JWT) are a compact way to represent claims between two parties. A JWT has three parts separated by dots: header, payload, and signature. The header and payload are Base64url-encoded JSON objects. Our decoder parses these so you can inspect the contents without running custom scripts.
The header usually contains the algorithm (e.g., HS256 or RS256) and token type. The payload holds claims such as sub (subject), exp (expiration), and iat (issued at). The exp claim is a Unix timestamp—we display it in ISO format and indicate whether the token is expired.
This tool only decodes the token; it does not verify the signature. Never trust decoded claims without signature verification in a secure environment. Avoid pasting production tokens into unknown tools—this tool runs entirely in your browser, but exercise caution with sensitive data.
sub, iss, aud, exp, and any custom claims your application has set.exp Unix timestamp to a human-readable date and indicates whether the token is currently valid or expired.Yes. This tool runs entirely in your browser using JavaScript. No token data is sent to any server. However, avoid pasting production tokens with sensitive claims into any tool you do not control. Use our Base64 Encoder/Decoder if you need to manually inspect individual token segments.
JWT tokens are Base64url-encoded, meaning anyone can decode and read the header and payload. Encoding is not encryption—it provides no confidentiality. If you need encrypted tokens, use JWE (JSON Web Encryption). For hashing and integrity checks, try our Hash Generator.
This typically happens due to clock skew between your server and client, or because the exp claim was set with a very short TTL. Verify that your server's system clock is synchronized and that token lifetimes match your application requirements. Our web development team can help design robust authentication architectures.