Enter JWT Token
JWTs contain three Base64URL parts separated by dots.
JWT Decoder
Decode and inspect JSON Web Tokens to view header, payload, and signature details.
JWT Decoder
Decode JSON Web Tokens, inspect claims, and optionally verify signatures—all locally in your browser.
Paste a JWT to inspect its contents.
Decoded Token
No token decoded yet.
—0 bytes—0 bytes—0 bytes—
Payload Details
- Status
- Decode a token to view claims.
Verification not requestedEnable signature verification and provide the correct credential when needed.
100% Secure
Tokens and credentials never leave your browser.
Modern Algorithms
Verify HMAC, RSA, RSA-PSS, and ECDSA.
Claim Details
Inspect timestamps and identity claims.
Export Options
Copy or download decoded JSON.
Privacy Focused
All decoding is performed on your device.
Practical guide
Using JWT Decoder with confidence
Reviewed by LipiCode Editorial Team
What this tool helps you do
A JSON Web Token commonly contains a header, payload, and signature separated by periods. Decoding reveals readable claims, but it does not establish that the signature is genuine or that the token should be trusted.
When it is useful
- Inspecting issuer and audience claims
- Checking expiry timestamps
- Debugging authentication flows
- Reviewing token headers and algorithms
A practical example
After decoding, compare exp with the current Unix time and confirm iss and aud match the service that will accept the token. Verification must still happen on the server with the expected key and algorithm.
Limitations and common mistakes
Never treat decoded content as verified. Avoid pasting production tokens into services you do not trust, and never put passwords or unnecessary personal data in a JWT payload because it is readable.
Frequently asked questions
Does decoding verify a JWT?
No. Signature validation is a separate cryptographic step.
Why is a token rejected before exp?
Issuer, audience, not-before time, signature, key rotation, or clock skew can also cause rejection.