How to Decode a JWT - Header, Payload & Signature Explained

🎟️Free JWT Decoder
Decode JSON Web Tokens and check expiry.Open tool →

The three parts

Header: the algorithm and token type. Payload: the claims – user ID (sub), issued at (iat), expiry (exp), audience, roles. Signature: proof the token wasn't changed, checked by the server with a secret or public key.

Decode one

Paste the token into the JWT Decoder to see the header and payload as formatted JSON, the issued and expiry times in readable form, and whether it has expired.

Decoding is not verifying

Anyone can decode a JWT – it's signed, not encrypted. Never put secrets in the payload, and always verify the signature on the server before trusting any claim.

Stay safe

Avoid pasting live production tokens into websites. This decoder runs entirely in your browser, but test or expired tokens are safest.

Frequently asked questions

Why is my token expired?

The exp time is in the past compared to your device clock.

What is 'none' algorithm?

An unsigned token – servers should reject it.

Where are JWTs stored?

Often in cookies or local storage; httpOnly cookies are safer.