JWT Decoder Guide: Inspect JSON Web Tokens, Claims & Expiry
When an authentication bug strikes, the fastest way to understand what's happening is to look inside the token. A JWT decoder reveals every claim, header, and expiry time in a read
When an authentication bug strikes, the fastest way to understand what's happening is to look inside the token. A JWT decoder reveals every claim, header, and expiry time in a readable format.
What is JWT Decoder Guide?
A JSON Web Token (JWT) is a compact, signed token used for authentication and information exchange. It has three Base64URL-encoded parts — header, payload, and signature. A JWT decoder splits and decodes these so you can inspect the claims without writing any code.
How to use it
- Paste your JWT (the long string with two dots) into the decoder.
- Read the decoded header and payload as formatted JSON.
- Check standard claims like exp (expiry), iat (issued at), and sub (subject).
- Verify whether the token is currently valid or expired.
Key features
- Header & payload decoding — See the algorithm, token type, and every claim instantly.
- Expiry checking — Know at a glance whether a token is active, not-yet-valid, or expired.
- Timeline visualization — Understand the issued-at, not-before, and expiry window.
- Fully client-side — Tokens are decoded in your browser and never transmitted anywhere.
Tips to get the most out of it
- A JWT is encoded, not encrypted — never store secrets in the payload.
- Decoding does not verify the signature; always validate signatures server-side.
- Check the exp claim first when debugging '401 Unauthorized' errors.
Frequently asked questions
Is it safe to paste my token here?
Decoding happens entirely in your browser — your token is never sent to a server.
Does the decoder verify the signature?
No. Decoding only reads the contents; signature verification requires the secret key and should be done server-side.
What does the exp claim mean?
It's the expiry time as a Unix timestamp; after that moment the token should be rejected.
Why are JWTs Base64-encoded, not encrypted?
Base64URL makes them URL-safe and compact; the signature ensures integrity, but the payload is readable by anyone.
Ready to try it? Open the tool and see your results instantly — it's free, needs no login, and runs entirely in your browser.
