Inspect JSON Web Token headers and payload claims without sending the token to a server. Check expiry (exp), not-before (nbf), issuer and audience claims. Decoding does not verify a token signature.
Decode and inspect JSON Web Tokens
A JSON Web Token (JWT) commonly carries claims used by authentication and authorization systems. This free JWT decoder separates the token into its header and payload so developers can inspect the algorithm label, token type, subject, issuer, audience, issued-at time and expiration time.
How to decode a JWT
- Paste the three-part JWT string into the token field.
- Select Decode Token.
- Review the decoded header and payload as formatted JSON.
- Check exp and nbf timestamps to understand token timing.
JWT decoding is not signature verification
Anyone who has a JWT can usually decode its Base64URL-encoded header and payload. This does not prove that the token is authentic or has not been modified. The tool does not verify signatures, validate issuer trust, or contact an identity provider. Always verify tokens on the server using the expected algorithm and trusted key.
Frequently asked questions
What are the three parts of a JWT?
A compact signed JWT typically contains a Base64URL-encoded header, payload and signature separated by periods.
What does the exp claim mean?
The exp claim is a NumericDate timestamp after which a token must not be accepted.
Related developer tools on SkillHost
Use these connected utilities as part of the same development workflow: convert API cURL requests into code, compare API response JSON, work with SQL queries using MySQL Toolkit. You can also browse all developer tools or explore practical developer projects and source-code examples on SkillHost.
Official documentation and further reading
For deeper implementation details, refer to the RFC 7519: JSON Web Token specification. Use the official specification or documentation to confirm runtime-specific behavior before deploying changes.
Privacy and browser processing
Core processing runs locally in your browser. SkillHost does not receive the text, code, tokens or data entered into this tool. Anonymous page-open and successful-use events may be recorded by SkillHost Tool Analytics; analytics events do not contain the submitted content.