JWT Header and Payload Decoder
Decode a three-part JWT header and payload in your browser and inspect its exp time. This tool does not verify signatures or trust.
This guide and page information are in English. Some controls inside the interactive tool currently appear in Turkish.
This tool processes its main input in your browser and does not send it to an external API. Fonts and interface assets may load from external providers.
JWT Header and Payload Decoder
The JWT viewer decodes the header and payload sections of a three-part token into readable JSON. If a numeric `exp` claim is present, it also compares that time with the current clock.
Decoding is not verification: the tool does not validate a signature, issuer, audience or authorization policy. Access tokens can be credentials. Use synthetic or revoked test data only, and verify real tokens with a trusted server-side library.
When is it useful?
- Inspecting claim names in a synthetic token used for development.
- Understanding the Unix time represented by a test token's `exp` claim.
How to use it
- Paste a three-part JWT created only for testing; do not use a production access token.
- Review the decoded header and payload, then read the `exp` timing note if it is available.
- Verify the signature, key, issuer, audience and permissions using trusted server-side code.
Example
Input: A synthetic three-part JWT with a JSON header and payload
Output: Readable header and payload JSON, with an `exp` time note when present
Who is it for?
- Developers learning JWT structure
- Teams inspecting synthetic authentication test data
- People reviewing claim names before server-side validation
Privacy and limitations
The token text is decoded with JavaScript in this page; this tool does not send it to a verification service. A real token can grant account access, so use synthetic or revoked test data and avoid shared screens.
Frequently asked questions
Does this page verify the JWT signature?
No. It decodes the header and payload only. Readable JSON does not prove that the token was issued by a trusted party or has not been changed.
What does the `exp` note tell me?
The `exp` claim commonly represents an expiry time as Unix seconds. This page compares that value with the current clock; it does not check all token validation rules.
Can I paste a real access token?
Do not. A bearer token may grant access to an account or service. Use synthetic or revoked test data and clear any screenshots or shared displays containing it.
Can I trust a role in the payload?
No. Claims are not trustworthy until the signature, issuer, audience, expiry and application policy have been verified. Enforce authorization on the server.