Back to Tools
JWT Decoder
JWT Decoder
Decode and view JSON Web Token Header and Payload data securely.
About the JWT Decoder
Read the contents of a JSON Web Token (JWT).
How to use the JWT Decoder
- Paste your token or click Sample.
- Press Process / Generate to see the header and payload.
- Use Copy or Download.
When to use the JWT Decoder
- Reading the claims inside a token while you debug a login or an API problem.
- Checking when a token was issued and when it expires.
- Confirming which user, role or scope a token carries.
- Learning how a JSON Web Token is put together.
Common mistakes to avoid
- Believing that a decoded token is a verified token. Anyone can create a token with any content, so only checking the signature on your server proves it is genuine.
- Putting sensitive data such as passwords in the payload. The payload is only encoded, so anybody who has the token can read it.
- Pasting live production tokens into online tools. Use test tokens, or revoke a token you pasted.
Tips
- A JWT payload is only encoded, not encrypted, so anyone can read it. Never put secrets inside.
- Decoding does not prove that a token is genuine.
- Do not paste live production tokens into online tools.
- Check the exp claim to see whether the token is still valid.
- Keep token lifetimes short and use refresh tokens for long sessions.
Frequently Asked Questions
The header, the payload and the signature, separated by dots.
The header (the algorithm and type), the payload (the claims) and the signature, separated by dots.
A standard signed JWT is not encrypted. It is Base64URL-encoded, so its contents can be read by anyone.
The expiry time of the token, given as a Unix timestamp in seconds.