JWT Decoder
Inspect any JWT’s header and payload client-side, with expiry status and an explicit unverified-signature warning.
Decode JSON Web Tokens instantly in your browser. Free JWT decoder with header, payload, expiry check and signature presence.
Calculator Inputs
About Decode JWT
Inspect any JWT’s header and payload client-side, with expiry status and an explicit unverified-signature warning.
Paste a token to see its header (algorithm, type) and payload (subject, expiry, custom claims) pretty-printed. The tool compares the exp claim against the current time and states plainly whether the token is live or expired.
Critical: decoding is not verifying. A valid-looking payload proves nothing without checking the signature against the secret or public key — this tool never sees secrets and never transmits the token. Everything runs in your browser.
Where it is used
Debugging auth flows, checking token expiry in support tickets, and learning JWT structure safely.
How to use the Decode JWT
- JWT (header.payload.signature) — enter the value (e.g. eyJhbGciOi…).
- Calculate — press the Calculate button to see the result instantly above.
Formula
Split on dots → base64url-decode segments 1–2 → compare exp claim to now.
Examples
Example
Frequently Asked Questions
- Why warn that the signature is unverified?
- Anyone can mint a well-formed token with any claims. Trust comes only from cryptographic verification with the issuer’s secret or key.
- Is it safe to paste production tokens here?
- Decoding is fully local — nothing leaves the page. Still, prefer test tokens: pasted secrets can linger in browser history or screenshots.
- What does "expired X days ago" imply?
- The token’s own exp claim passed. Servers should reject it; if yours accepts it, the expiry check is missing or broken.