How do I decode a JWT token?

Paste the full JWT token (the long string with two dots separating three parts) into the input field. The tool instantly decodes the header (algorithm, type) and payload (claims, expiration, issuer) without needing any secret key.

Is it safe to paste my JWT token here?

Yes. The decoding happens entirely in your browser using JavaScript — no data is sent to any server. JWTs are encoded (Base64URL), not encrypted, so decoding doesn't require your secret key.

What are the three parts of a JWT?

A JWT has three Base64URL-encoded parts separated by dots: the Header (algorithm and token type), the Payload (claims like user ID, expiration, roles), and the Signature (cryptographic proof the token hasn't been tampered with).

How do I check if my JWT is expired?

Paste your token and look at the exp (expiration) claim in the decoded payload. The tool shows both the raw Unix timestamp and a human-readable date, plus an indicator showing whether the token is currently expired.

JWT 解码

解码 JWT：头部、载荷与过期时间

JWT Token

Inspect JWT claims without touching production

Authentication bugs are often token bugs — a missing claim, a wrong audience, an expired exp, the wrong algorithm. Decoding a JWT in the browser shows you the header, payload, and expiry instantly without sending the token to any server, so you can debug login, authorization, and API access issues with confidence.

Use the decoder when you need to

Debug an expired or rejected token

Look at the exp, nbf, and iat claims to confirm whether the token is past its lifetime or not yet valid.

Verify the claims your backend expects

Check that the audience, issuer, scopes, and custom claims match what your authorization layer requires.

Audit a token before pasting it into a ticket

Decode the payload to confirm there's nothing sensitive inside before sharing the token in a bug report.

How to decode a JWT quickly

1
Paste the JWT (the long string with two dots) into the input field.
2
Inspect the decoded header, payload, and expiry status.
3
Copy specific claims or the full payload for use in a bug report or test.

Keep going

Decode arbitrary Base64

Use the encoder/decoder when the value isn't a JWT but is still Base64-encoded.

Test an authenticated request

Replay the request that produced the token to verify auth end-to-end.

Format the payload

Beautify the decoded payload before pasting it into another tool.

Validate the payload

Run a syntax check on custom claims if your decoder produced unusual output.

Common JWT debugging workflows

Diagnose 401 errors from an API

Decode the token to see if the expected claim is missing or the audience is wrong.

Check token expiry during integration

Confirm a freshly minted token's expiry matches your auth provider's configured lifetime.

Audit roles and scopes

Verify the user has the right scopes before troubleshooting authorization in your code.

常见问题

把完整的 JWT（由两个点分隔成三段的长字符串）粘贴到输入框。工具会立刻解码 header（算法、类型）和 payload（claims、过期时间、签发方等），不需要任何 secret key。

安全。解码完全在你的浏览器里用 JavaScript 完成，不会把数据发送到服务器。JWT 是编码（Base64URL）而不是加密，所以解码不需要你的密钥。

JWT 由三段 Base64URL 编码内容组成，用点号分隔：Header（算法与 token 类型）、Payload（claims，例如用户 ID、过期时间、角色等）、Signature（用于证明 token 未被篡改的签名）。

粘贴 token 后查看解码后的 payload 里的 exp（expiration）字段。工具会同时显示原始 Unix 时间戳和可读日期，并提示当前是否已过期。