How to use the jwt decoder
- Paste a JWT. A leading “Bearer ” is removed for you.
- Read the header and payload.
- Check the issued and expiry times.
Decoding isn’t verifying
A JWT’s header and payload are only Base64URL-encoded, so anyone can read them. This tool doesn’t check the signature, so it can’t tell you whether the token is genuine. Don’t paste production tokens into tools you don’t trust; this one runs entirely in your browser.
Examples
{"alg": "HS256", "typ": "JWT"} and the payload
Expires 2027-01-01T00:00:00Z