JWT Decoder
Paste a JWT token to decode and inspect its header, payload and signature. Checks expiry automatically.
JSON Web Tokens (JWT) are the standard for stateless authentication in web applications and APIs. A JWT is a compact, base64-encoded string containing a header (algorithm and token type), a payload (claims like user ID, roles, and expiry), and a signature. Debugging authentication issues often requires inspecting the JWT payload — this decoder instantly reveals all three sections and checks whether the token has expired, without sending your token to any server.
📋 How to Use This Calculator
Paste your JWT token (the long string starting with "eyJ") into the input field and click "Decode JWT." The tool splits the token at the two dots, base64-decodes each part, and displays the header and payload as formatted JSON. The signature (third part) is shown as-is — it cannot be decoded without the secret key. If the payload contains an "exp" claim, the tool automatically computes whether the token is still valid based on the current time and shows the expiry date. Copy individual sections or use them in your debugging workflow.
💡 Key Facts & Information
JWT tokens consist of three base64url-encoded parts separated by dots: Header.Payload.Signature. Base64url is similar to standard base64 but uses - instead of + and _ instead of /, with no padding. The header typically contains {"alg": "HS256", "typ": "JWT"}. The payload contains claims — registered claims like "sub" (subject), "exp" (expiry in Unix seconds), "iat" (issued at), and "nbf" (not before), plus custom claims. The signature is HMAC-SHA256 (for HS256 tokens) of the base64-encoded header+payload — you cannot verify the signature without the server secret, but you can read the claims without verification (which is fine for debugging, not for security decisions).