Loading Shrinkify...
Loading Shrinkify...
Decode JWT tokens to inspect header, payload, and signature. Debug auth tokens safely in your browser.
15 powerful converters: URL, Base64, JSON, HTML, Hash, JWT, Case, UUID, Timestamp, Hex, Binary, URL Params, Text Stats, Website Screenshot
JWTs are the backbone of modern API authentication, but their base64-encoded payloads are opaque without a decoder. The JWT Decoder splits header, payload, and signature — giving you instant readable access to claims, expiry, issuer, and algorithm.
exp claim to diagnose token expiry errors.iss and aud match expected values.Decoding reads the claims without checking the signature. Always perform server-side signature verification before trusting JWT content in application logic.
Working with raw Base64 segments? Use the Base64 Decoder for segment-level inspection.
No. Decoding reads the claims without verification. Always verify the signature server-side before trusting any JWT claim.
The expiry timestamp in Unix seconds. If the current time exceeds exp, the token is expired and should be rejected.
Common algorithms include HS256 (HMAC-SHA256) for symmetric signing and RS256 (RSA-SHA256) for asymmetric key pairs.
Check out our technical guides to learn more about how browser-side processing works.
Read Glossary