Header and payload
See the algorithm, token type and every claim as formatted JSON.
JWT Decoder
Decode JSON Web Tokens and check expiry, issuer and claims.
- Free
- No sign-up
- Runs in your browser
- Developer
Loading tool…
Was this tool useful?
Why use it
JSON Web Tokens carry claims such as the user, the issuer and the expiry time in a base64url-encoded payload. Paste a token to read those claims and check whether it has expired, which is often all you need when debugging authentication in a headless or API-driven app.
Readable times
Issued-at, not-before and expiry are shown in your local time, with a live countdown.
Stays on your device
Tokens are decoded locally in the browser and never sent anywhere.
How to use it
4 quick steps. Going deeper? Read Headless WordPress with Next.js App Router: a production architecture guide.
- 01
Paste a token in the form xxxxx.yyyyy.zzzzz.
- 02
Read the decoded header (algorithm and type) and payload (claims).
- 03
Check the timeline: issued at, not before and expires, shown in your local time.
- 04
Remember that decoding is not verifying: only the server with the key can confirm the signature.
Who it’s for
Typical situations where this tool saves time.
- API developersCheck why a request returns 401: expired token, wrong audience or missing claim.
- Frontend developersConfirm what your login flow stores before relying on a claim in the UI.
- QA and supportRead a test token's user and role without asking a developer.
Questions
Short answers about privacy, limits and how the tool works.
Does this verify the signature?
No. Verifying needs the secret or public key, which should stay on your server. This tool only decodes the header and payload, which anyone holding the token can read.
Is it safe to paste a production token?
The token is decoded locally and never sent anywhere. Still, treat live tokens like passwords and prefer expired or test tokens when you share screenshots.
Why is my token reported as expired?
The exp claim is a Unix timestamp in seconds. If it is earlier than the current time, servers will reject the token; request a new one or check your system clock.
Need a tool like this inside your product?
I build custom calculators, admin utilities and integrations for WordPress, Laravel and Next.js teams.