Paste a JWT here: the three dot-separated parts.

JWT Decoder & Viewer

Paste a JSON Web Token to see its header and payload as formatted, highlighted JSON: handy for checking claims, scopes, audience or expiry while debugging authentication.

What you get

• The header (algorithm, token type, key ID) and the payload's claims in separate JSON views.
• Claims exactly as encoded: timestamps such as exp and iat are Unix seconds.

Important

This only decodes the token. It does not verify the signature, so it can't tell you whether a token is genuine or has been tampered with: anyone can create a token with any claims. Decoding happens in your browser and the token isn't sent anywhere, but treat production tokens as secrets all the same.

Try it

Decode a sample token

Good to know

A token is recognised when it has three base64url parts and both the header and payload decode to JSON objects. Encrypted tokens (JWE) can't be read without their key.

Related: JSON formatter · Certificate decoder · Base64 decoder