What is JWT Decoder & Inspector Online?
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties, defined by RFC 7519. Every JWT has three parts separated by dots: a Base64-encoded header (algorithm), a Base64-encoded payload (claims), and a signature. Our JWT decoder & inspector online allows you to view the contents of any token without needing to write code or share secrets. The tool instantly decodes the header and payload for quick inspection of token contents, expiry times (`exp`), and issuer data (`iss`). This is remarkably useful for debugging authentication issues, verifying that your backend is issuing the correct claims, or checking if a token has already expired. Security is our top priority. Because JWTs are decoded locally using Javascript in your browser, your tokens never leave your device. This makes our inspector a safe sandbox for debugging production-equivalent tokens without the risk of leaking sensitive session data to a third-party server.
How to Use JWT Decoder & Inspector Online
- Paste your JWT token into the input field.
- The header and payload are decoded and displayed instantly.
- Check the exp claim to see when the token expires.
Example
Decoded JWT header
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...Output
{ "alg": "HS256", "typ": "JWT" }Developer Tips
Always check the "exp" claim first when debugging "Unauthorized" errors. A clock skew between your server and client can sometimes cause tokens to be rejected even if they seem valid.
Frequently Asked Questions
Is it safe to paste my JWT here?
Yes. JWTs are decoded client-side. Your token never reaches a server. That said, never share real JWTs from production systems in untrusted environments.
Can this tool verify a JWT signature?
JWT signature verification requires the secret key. This tool decodes the header and payload only. Use server-side libraries like jsonwebtoken for full verification.
What does "exp" mean in a JWT?
"exp" is the expiration time as a Unix timestamp (seconds since Jan 1, 1970). If the current time exceeds this value, the token is expired and invalid.