header.payload.signature
JWT Decoder
Decode any JSON Web Token in real time. Paste your token below and see the header, payload, and signature split apart and syntax-highlighted, with an instant expiration check.
What is JWT Decoder?
Decode any JSON Web Token in real time. Paste your token below and see the header, payload, and signature split apart and syntax-highlighted, with an instant expiration check. Everything runs 100% client-side in your browser — no data is ever uploaded to a server, nothing is logged or stored, and the tool is completely free with no signup required.
Quick Answers
- Is it safe to paste a production JWT here?
- Yes. Decoding happens entirely in your browser using JavaScript — the token is never transmitted to any server, logged, or stored. You can verify this by checking your browser's network tab while using the tool.
- Can this tool verify the signature, or only decode?
- This tool decodes and inspects the header and payload, and checks the expiration claim locally. It does not verify the cryptographic signature, since that would require the signing secret or public key, which you should never paste into a third-party website.
- Why does my token show 'expired' even though it still works in my app?
- Some backends deliberately allow a grace period ('leeway') after the exp timestamp passes, or don't check expiration at all. This tool reports the raw exp claim compared to your current system clock.
All decoding happens entirely in your browser. No data is ever sent to a server — nothing you paste here is transmitted, logged, or stored.
Frequently asked questions
Is it safe to paste a production JWT here?
Yes. Decoding happens entirely in your browser using JavaScript — the token is never transmitted to any server, logged, or stored. You can verify this by checking your browser's network tab while using the tool.
Can this tool verify the signature, or only decode?
This tool decodes and inspects the header and payload, and checks the expiration claim locally. It does not verify the cryptographic signature, since that would require the signing secret or public key, which you should never paste into a third-party website.
Why does my token show 'expired' even though it still works in my app?
Some backends deliberately allow a grace period ('leeway') after the exp timestamp passes, or don't check expiration at all. This tool reports the raw exp claim compared to your current system clock.
What's the difference between the header, payload, and signature?
The header describes the token type and signing algorithm. The payload holds the claims — the actual data, like user ID or expiry. The signature is a cryptographic hash of the header and payload used to verify the token wasn't tampered with.
Quick comparison
JWT vs Opaque session token — key differences
A JSON Web Token is a self-contained, signed token whose claims are readable by decoding the payload. Opaque session tokens are random strings that must be looked up in a server-side store. The choice affects how you design authentication.
| Aspect | JWT (JSON Web Token) | Opaque session token |
|---|---|---|
| Contents | Signed header + payload with readable claims | Random string with no readable data |
| Validation | Stateless — verify signature locally | Requires a database or cache lookup |
| Revocation | Hard — a stolen token stays valid until expiry | Trivial — delete the session row |
| Storage | Stateless server, no session store needed | Server must persist every session |
| Best for | Distributed services and API gateways | Traditional web apps and one server |
How to decode a JWT in 3 steps
A JWT has three dot-separated parts: the header, the payload, and the signature. You only need the first two to inspect the token — and this tool shows all of them side by side, decoded, without ever sending the token to a server.
- 1Copy your JWT (the full header.payload.signature string, including the dots) from your app, browser devtools, or an API response.
- 2Paste it into the input box above. The header and payload are decoded instantly, and any exp, nbf, iss, sub or aud claims are called out separately.
- 3Read the decoded payload to see what the token actually contains. Nothing is uploaded, logged, or stored — close the tab and the token is gone.