▶ Subscribe on YouTube
Home / Tools / Developer Tools

JWT Decoder

Decode and inspect JWT tokens without a secret.

JWT Token

What does this tool do?

A JWT (JSON Web Token) is a compact, self-contained string used for authentication. After you log in, the server gives you a JWT, and you send it with every subsequent request to prove who you are. A JWT has three sections separated by dots: the header (which signing algorithm was used), the payload (the actual data — user ID, roles, permissions, expiry time), and the signature (proof the token has not been tampered with). This tool decodes the first two so you can read what is inside them. No secret key is needed for decoding.

How to use it

  1. Copy a JWT from your browser's developer tools, an API response, a cookie, or an auth header.
  2. Paste it into the input field.
  3. The decoded header and payload appear instantly.
  4. Check the exp field — it is a Unix timestamp showing when the token expires.

Pro tips

  • The payload is Base64-encoded, not encrypted. Anyone with the token can read it. Never put passwords or secrets in a JWT payload.
  • The exp field is a Unix timestamp. Use the Unix Timestamp Converter on this site to convert it to a readable date.
Example

Token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMTIzIiwiZXhwIjoxNzAwMDAwMDAwfQ.xxx

Header: { "alg": "HS256" }
Payload: { "sub": "user123", "exp": 1700000000 }

(exp = November 14, 2023 — this token has expired)

When would you use this?

  • Checking what user claims a token contains when debugging an authentication problem
  • Verifying that a token has the correct roles or permissions for an endpoint
  • Checking when a JWT expires without needing to write code
  • Understanding what data your auth provider (Auth0, Cognito, Firebase) puts inside tokens