Davemi ToolsJWT Decoder
Paste a JSON Web Token to decode its header and payload, read every claim, and check expiry — instantly. Everything runs in your browser; your token is never uploaded.
Encoded Token
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It's the backbone of modern authentication — after you log in, an API often hands your app a JWT that proves who you are on every later request. A JWT has three Base64URL-encoded sections joined by dots: the header(which signing algorithm was used), the payload (the claims, like the user ID and expiry), and the signature (which lets the server confirm the token wasn't tampered with).
How to use this tool
- Paste your JWT into the box — a leading
Beareris removed automatically. - The header and payload decode instantly as you type.
- Read the Claims explained table for a plain-English meaning of each field.
- Check the badges for the algorithm and whether the token is active or expired.
JWT structure
| Header | Signing algorithm (alg) and token type (typ). |
| Payload | Claims: registered (iss, sub, exp…), public, and private/custom. |
| Signature | HMAC or RSA/ECDSA signature over the header and payload. |
Privacy & security
- Decoding happens 100% in your browser — nothing is uploaded.
- This is a decoder, not a validator: signatures are never verified here.
- Never paste production tokens into server-side online decoders.
- A JWT is only Base64-encoded, not encrypted — never store secrets in the payload.
Frequently Asked Questions
What is a JWT (JSON Web Token)?
A JWT is a compact, URL-safe token used to securely transmit information between parties as a JSON object. It has three Base64URL-encoded parts separated by dots: a header (algorithm and type), a payload (the claims/data), and a signature. JWTs are widely used for authentication and authorization in web and mobile apps.
Does this JWT decoder send my token to a server?
No. Decoding happens entirely in your browser using JavaScript — your token is never uploaded, logged, or stored anywhere. That matters because a JWT often grants access to an account, so pasting it into a server-side tool would be a security risk.
Does decoding a JWT verify its signature?
No. Decoding only Base64URL-decodes the header and payload so you can read the claims. Verifying the signature requires the secret key (HS256) or public key (RS256/ES256), which should never be exposed in a browser. Always verify signatures on your server before trusting a token.
Is it safe to paste a JWT into an online decoder?
It's safe here because everything runs locally in your browser and nothing leaves your device. As a general rule, avoid pasting production tokens into tools that process them on a server — a leaked JWT can be replayed until it expires.
What do exp, iat, and nbf mean?
They are registered time claims stored as Unix timestamps (seconds since 1970). 'exp' is the expiration time (the token is invalid on or after it), 'iat' is when the token was issued, and 'nbf' is 'not before' (the token is invalid until then). This tool converts each to a readable date and shows whether the token is currently expired.
Why is my token shown as expired?
If the payload contains an 'exp' claim whose timestamp is in the past, the token is expired and a server would reject it. Decoding still works — you can read every claim — but you'd need a freshly issued token to authenticate.
What's the difference between HS256 and RS256?
HS256 signs the token with a single shared secret (symmetric). RS256 signs with a private key and verifies with the matching public key (asymmetric), which is safer when many services need to verify but only one issues tokens. The algorithm is shown in the header's 'alg' field.
Related tools
More free, private, browser-based utilities — no upload, no sign-up.