Free JWT Decoder & Inspector
Paste any JWT token to instantly decode the header, inspect the payload claims, check the expiry timestamp and verify the signature. Works with HS256, RS256, and all standard JWT algorithms. Completely browser-based — your tokens never leave your device.
✅ Decode Header & Payload✅ Check Expiry✅ Verify Signature✅ HS256 / RS256✅ 100% Private✅ No Signup
Frequently Asked Questions
How do I decode a JWT token?
Paste the JWT token into the input box. A JWT has three dot-separated parts. The tool base64-decodes each part and displays the header algorithm, payload claims (user ID, email, roles, expiry) and signature in a readable format.
What are JWT claims?
Claims are key-value pairs in the JWT payload. Standard claims include: sub (subject/user ID), exp (expiry time), iat (issued at), iss (issuer), aud (audience). Custom claims can include user roles, permissions, or any application data.
Why is my JWT showing as expired?
The 'exp' claim is a Unix timestamp. If the current time is past that timestamp, the token has expired. You need to refresh the token via your auth server to get a new one.
Can I verify JWT signatures here?
Yes, HMAC-signed JWTs (HS256) can be verified by entering the secret key. For RSA-signed JWTs (RS256), paste the public key to verify. Without the key, you can still inspect all header and payload claims.
