JWT Decoder
Decode and inspect JSON Web Tokens.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1024",
"name": "Ada Lovelace",
"iat": 1755200000,
"exp": 1786736000
}What is a JWT Decoder?
A JSON Web Token is three Base64URL-encoded parts joined by dots: header.payload.signature. The header names the signing algorithm, the payload holds the claims, and the signature proves the first two have not been altered. Only the signature is opaque — the header and payload are encoded, not encrypted, so anyone holding the token can read them.
That is the point worth internalising: a JWT payload is public to whoever has the token. Putting anything confidential in it is a mistake, because a decoder like this one reads it in a keystroke.
This tool decodes and does not verify. Verification needs the shared secret or the issuer’s public key, and pasting a production secret into a web page is exactly what you should not do.
When you need it
- A request is returning 401 and you want to know whether the token has simply expired.
- You need the
sub,scopeor a custom claim from a token captured in a request. - You are checking that an identity provider issues the claims your service expects.
- A token is being rejected and you want to see which
algandkidit declares. - You are confirming that no sensitive data has been placed in a payload.
How to use the JWT Decoder
- Paste the whole token, including both dots. Decoding starts as you type.
- Read the header on the left —
algandtyp, sometimeskid. - Read the payload on the right — the claims, formatted as JSON.
- Check the status line under the panels: it converts
expinto a real date and says whether the token is still valid. - Copy either panel if you need the JSON elsewhere.
Examples
JWT Decoder features
Frequently asked questions
Does this verify the signature?
No, deliberately. Verifying requires the signing secret or public key, and you should not paste a production secret into a web page. Verify in your backend, where the key already lives.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and the token is never transmitted. That said, a live token is a credential — if it is still valid, treat it with the same care as a password.
Can anyone read my JWT payload?
Yes. The payload is Base64URL-encoded, not encrypted. Anyone with the token can read every claim, so never place secrets in it.
My token has more or fewer than three parts.
Then it is not a standard signed JWT. Five parts means a JWE (an encrypted token), which cannot be decoded without the key. Two parts usually means a truncated copy-paste.
Why does a token look expired when the server accepts it?
exp is in UTC seconds, and most servers allow a small clock-skew tolerance. A token a few seconds past its expiry is often still accepted.
Is my data uploaded to a server?
No. Every iZZi DevTools tool runs inside your browser using the standard web platform. The data you paste is processed on your own machine and is never transmitted, stored or logged by us.
Do I need an account?
No. Every core tool is free, unlimited and works without signing in. An account only adds conveniences such as saved snippets and history.
Does it work offline?
Once the page has loaded, yes. Because the processing happens in the browser rather than on a server, the tool keeps working if your connection drops.