Loona JWT Decoder - Read Header & Payload, Check Expiry
A JWT looks like one long unreadable string, but the first two parts are just Base64url-encoded JSON. Paste a token to read what it claims - who it is for, when it expires - while debugging. Use it for inspection only; real trust requires signature verification on a server.
How to use the JWT Decoder
- Paste the full token (all three parts) into the box.
- Click Decode Token.
- Read the header and payload, and check the expiry line - then verify the token properly in your own system before trusting it.
How it works
A JWT is three Base64url strings joined by dots: header.payload.signature. The header names the signing algorithm; the payload carries claims such as sub (subject), iat (issued-at) and exp (expiry, as a Unix timestamp in seconds). This tool decodes the first two parts from Base64url to JSON - the exact same decoding your own code does - and converts the numeric time claims into human dates. The third part, the signature, is shown as present but is NOT checked: verifying it needs the secret or public key and must happen in your backend.
Worked example
Decoding the classic sample token shows header {"alg":"HS256","typ":"JWT"} and a payload with sub "1234567890" and iat 1516239022 - which the tool renders as "Thu, 18 Jan 2018 01:30:22 GMT", far easier to reason about than the raw number.
Frequently Asked Questions
Is this JWT decoder free?
Yes - free, no sign-up, no limits.
Does this tool verify the token?
No. It decodes only. A decoded token proves nothing about authenticity - anyone can write any payload and encode it. Signature verification requires the key and belongs on your server.
Why does the payload look readable at all?
JWT parts are encoded, not encrypted. Encoding is for transport, not secrecy - never put secrets in a JWT payload.
Is it safe to paste a real token here?
Your token is decoded 100% in your browser and never uploaded. Even so, good practice is to avoid pasting live production tokens into any tool - use a test token with the same shape.
What does "exp" mean?
The expiry time of the token as a Unix timestamp in seconds. This tool converts it to a readable date and tells you whether it has already expired.
Related Developer Tools
JSON Formatter
Validate, pretty-print and minify JSON, with the exact position of any error.
Base64 Encoder & Decoder
Encode text and files to Base64, or decode it back - UTF-8 safe, URL-safe option included.
URL Encoder & Decoder
Percent-encode text and URLs safely, with a per-character breakdown table.