JWT Decoder
Decode a JWT's header and payload.
Sign in to use this tool
Create a free account to unlock every tool — plus a 14-day free trial of HQ Pro, no card required.
About the JWT Decoder
Decode a JWT free and inspect exactly what's inside. Paste a JSON Web Token and instantly see its header (algorithm, type) and payload claims — exp, iat, sub, roles, and custom fields — as formatted JSON. Perfect for debugging auth flows, checking token expiry, and verifying what your API actually issued. Decoding happens entirely in your browser, so tokens are never sent anywhere — but remember this inspects, not verifies: always validate signatures server-side.
How to use the JWT Decoder
- 01Paste your JWT.
- 02Read the decoded header and payload as formatted JSON.
- 03Inspect claims like exp, iat, and sub.
Frequently asked questions
Does this verify the signature?
No — it only decodes the token for inspection. It does not validate the signature, so never trust decoded claims without server-side verification.
Is my token sent to a server?
No. Decoding happens entirely in your browser.
Why does my JWT say it's expired?
The exp claim is a Unix timestamp — if it's in the past, servers reject the token. Compare it against the current epoch time to see how long ago it lapsed.