JWT Decoder
Decode a JWT's header and payload, and check expiry.
About the JWT Decoder
Paste a JSON Web Token to decode its header, payload, and raw signature. Standard time claims like iat and exp are shown as human-readable dates, with a warning if the token has expired. This tool decodes only and does not verify the signature.
Popular uses
- jwt
- json web token
- decode
- jwt.io
- auth
Examples
Decode sample token
eyJhbGciOiJIUzI1NiJ9...Output
JSON{"sub":"1234567890","name":"John Doe","iat":1516239022}Keyboard shortcuts
- Copy the main outputCtrl / ⌘ + Shift + C
- Download the resultCtrl / ⌘ + S
- Share this toolCtrl / ⌘ + Shift + S
- Reset the inputsAlt + R
- Open the tool search paletteCtrl / ⌘ + K
Related tools
Base32 Encoder
Encoders & Crypto
Encode or decode text using RFC 4648 Base32.
Base64 Encoder
Encoders & Crypto
Encode or decode text to/from Base64, UTF-8 safe.
HTML Entity Encoder
Encoders & Crypto
Encode or decode HTML entities in text.
URL Encoder
Encoders & Crypto
Encode or decode strings using encodeURIComponent/encodeURI.
Basic Auth Header Generator
Encoders & Crypto
Build or decode an HTTP Basic Authorization header.
File Base64 Encoder/Decoder
Encoders & Crypto
Convert any file to a Base64 data URI, or decode Base64 back to a file.
Works well with
Next steps from other categories.
JWT Inspector
Security
Decode a JWT and audit its claims for common issues.
JSON String Unescape
JSON
Reverse JSON string escaping back to readable text.
String Escaper
Dev Utilities
Escape and unescape strings for JSON, JS, HTML, XML, SQL, RegExp, and shell.
Frequently asked questions
Read more
- Who pays for free developer tools?
Ads, data harvesting, upsells or donations — the four business models behind free online tools, and why the choice affects your privacy.
- Understanding JWT: structure, claims and safe verification
What is actually inside a JSON Web Token, which claims matter, and why decoding a JWT is not the same as verifying it.
- How TOTP two-factor codes actually work (and why 30 seconds matters)
A six-digit code every half minute, no network required. Here is what HMAC-SHA1, a shared secret and the Unix timestamp are actually doing.
- A browser API client with environments, history and saved requests
Environment variables, request history and a saved collection turn a one-off request form into something you can actually work in — without installing a desktop client.
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser