JWT Decoder (Header & Payload Inspector)
Local ProcessingDecode Base64URL-encoded JSON Web Tokens into formatted JSON header and payload claims locally in your browser.
How It Works & Processing Standards
Decode Base64URL-encoded JSON Web Tokens into formatted JSON header and payload claims locally in your browser.
Tool processing runs in your browser. If you create a calculator or conversion share link, its values are included in the URL. See the privacy policy for account, analytics and advertising data.
Current Limits
- Maximum input length: 100,000 characters
A JWT is three Base64URL parts (header, payload, signature) separated by dots. Paste one to see the header and payload as readable JSON, or choose expiry check or structure check under "Task".
The signature is not verified. Being able to read the content does not mean the token is genuine.
What You Can Do
- Decode
- Header (alg, typ) and payload claims as indented JSON.
- Expiry check
- Reads the exp claim and tells you when and whether it expires.
- Structure check
- Checks segment count, Base64URL and JSON, and says why it fails.
How to Use JWT Decoder (Header & Payload Inspector)
- 1Choose a taskDecode, expiry check or structure check.
- 2Paste the tokenPaste a JWT starting with eyJ.
- 3Read the resultSee the header and payload or the check result.
Examples
Common Use Cases
- Seeing which user details a login token carries
- Checking whether a token expired when an API returns 401
- Quickly spotting a malformed token
Frequently Asked Questions (FAQ)
Is it safe to paste a token?
Decoding happens only in your browser and the token is not sent to a server. Still, revoke or let production tokens expire after inspecting them.
Expiry check says there is no exp claim.
The token carries no expiry time. The issuing server may track expiry separately.