About this tool
Decode and inspect a JSON Web Token header and payload.
A JSON Web Token (JWT) consists of three Base64URL-encoded parts separated by dots: header (algorithm and token type), payload (claims like user ID and expiry), and signature (for verification). The raw.tools JWT Decoder splits any JWT and shows the decoded header and payload as formatted JSON. The signature is displayed but not cryptographically verified — use this for debugging and inspection.
Example
Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.xxx
Header: {"alg":"HS256","typ":"JWT"} · Payload: {"sub":"1234567890"}
How to use
- Paste your JWT token in the input field.
- Header and payload are decoded immediately.
- Examine claims (iss, exp, iat, sub, etc.).
- Check the <code>exp</code> timestamp — the tool converts it to a human-readable date.
Features
- Header, payload and signature decoded
- Formatted JSON output
- exp timestamp → human-readable date
- All standard JWT claims highlighted
- No signature verification required
Frequently Asked Questions
What are the three parts of a JWT?+
Header (algorithm and type), payload (claims like user ID, issuer, expiry), and signature (used by the server to verify authenticity).
Can I verify the signature here?+
No — verification requires the secret key or public certificate. This tool is for inspection only. Use your server-side auth library for verification.
What is the <code>exp</code> claim?+
exp is the expiry time as a Unix timestamp (seconds since 1970). The decoder shows it as a human-readable date so you can tell if the token is expired.
Is it safe to paste a JWT here?+
All decoding runs in your browser — the token is not uploaded. Avoid pasting production tokens in any shared or public environment as a general practice.
Can the tool verify a JWT signature?+
No — verification requires the secret key. This tool decodes the header and payload without signature verification. Use it for inspection, not security checks.
What does "exp" in the JWT payload mean?+
exp is the expiration timestamp (Unix epoch). If the current time is past exp, the token has expired and should be rejected by the server.