A JWT looks like random characters, but two of its three parts are just Base64-encoded JSON. Anyone holding the token can read them. Decoding shows which user it's for, which permissions it carries and when it runs out.
Paste a token and the header and payload appear as formatted JSON. Timestamps such as iat and exp are shown as dates, with a note if the token has expired. This is safe to do with real tokens here, because nothing is sent anywhere.
How to use the JWT Decoder tool
- Paste the token.
- Read the header and the payload.
- Check the expiry and the claims.
Popular uses
- Debugging a login that fails or expires too soon
- Checking which roles and scopes an API token carries
- Learning how JWTs are put together
Tips for the best result
- A leading "Bearer " copied from a request header is ignored.
- Never put secrets in a JWT payload. As this page shows, anyone can read it.
Quick facts
| Price | Free |
|---|---|
| Works with | JWT |
| Where it runs | In your browser, on your device |
| Account | Not needed |