JWT Decoder
Decode JWT headers, payloads and common time claims locally.
About JWT Decoder
JWT Decoder makes the header and payload of a three-part JSON Web Token readable. Paste a token and select Decode token to inspect its JSON fields, with readable dates for supported issued-at and expiry claims. This is useful when debugging an authentication integration or checking what a test token contains without writing a separate decoding script.
The tool does not verify the signature or decide whether a token should be accepted. Anyone can construct readable token contents, so a decoded issuer, subject or expiry is only a claim until your application verifies it. Use a harmless test token whenever possible, avoid sharing real bearer tokens, and keep authentication decisions in the application that validates the issuer, signature and required claims.
How to use JWT Decoder
- Paste a token
Enter a three-part token in JWT token, with periods separating the sections.
- Decode the contents
Select Decode token. Invalid structure or JSON produces an error.
- Inspect the fields
Read Header and Payload. Supported iat, exp, iss and sub claims may also appear in a summary.
- Copy or clear
Use Copy payload if needed, or Clear to remove the input and decoded result.
Example: A harmless demonstration token
This token has a demo subject and an intentionally invalid demonstration signature. The decoder can read it, which illustrates why decoding is not authentication.
Input
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZW1vIn0.exampleOutput
Header: {"alg":"HS256"}
Payload: {"sub":"demo"}How it works
A common signed JWT contains three dot-separated sections: an encoded header, an encoded payload and a signature section. This decoder checks for three sections, converts Base64url characters in the first two to a form the browser can decode, and parses their text as JSON objects. It displays those objects without evaluating their contents as code. The third section is not cryptographically checked.
Numeric iat and exp claims are interpreted as seconds since the Unix epoch and displayed using the browser’s local date formatting. The tool also summarizes string issuer and subject claims when present. These displays help inspection, but they do not enforce expiration, audience, issuer, algorithm or signature rules. An encrypted token with a different structure is not supported. Successful decoding means only that the first two sections were readable JSON objects, not that the token is authentic or authorized.
When is this useful?
- Inspect claims in a development token.
- Read expiry timestamps while debugging an integration.
- Compare the payload fields expected by an application.
Things to know
- No signature, issuer, audience or trust validation is performed.
- Only three-part tokens with JSON-object headers and payloads are supported.
- Decoded claims can be edited or forged; readable output is not an authorization decision.
Privacy & processing
The token is decoded with browser Base64 and JSON functions. It is not sent to an authentication service or ToolMyth processing server. Clear removes the current tool input and result; it does not revoke a token.
Frequently asked questions
Does Decode token check the signature?
No. It reads the header and payload but performs no cryptographic signature verification.
Why can a fake token still decode?
The first two sections can contain readable JSON even when the signature is invalid. Decoding alone cannot establish trust.
Does the expiry display mean the token is valid?
No. It translates a numeric exp claim into a local date. Your application must verify and enforce its token rules.
Does Clear log me out or revoke the token?
No. It clears this tool’s input and result only; it does not contact the token’s issuer.