JWTs let servers issue compact, verifiable claims to clients. This tool decodes the two JSON parts of any token and checks its expiry — useful for debugging auth flows, logging in tests, or inspecting tokens from third-party providers.
Anatomy of a token
A JWT has three dot-separated segments: the header (algorithm and type), the payload (claims), and the signature. This decoder base64url-decodes the first two and pretty-prints them so you can read the claims at a glance.
Decoding vs verifying
Anyone can read the payload of a JWT — it's only base64url, not encrypted. Security comes from the signature, which only the holder of the secret or public key can verify. This tool decodes for inspection; it never verifies, because verification needs a key.
Frequently asked questions
A JSON Web Token is a compact, signed token made of three base64url-encoded parts — header, payload and signature — commonly used for authentication and authorization in APIs.
No. This decoder only reads the header and payload. Verifying the signature requires the token's secret or public key — this tool never asks for them, since they should never leave your server.
The exp (expiry) claim is a Unix timestamp. The tool compares it to the current time and tells you whether the token has already expired.