JWT Decoder
Paste a JSON Web Token and instantly see its decoded header and payload, with iat, exp, and nbf timestamps translated into your local time and a live expired-or-valid badge. Decoding happens entirely in your browser — the token is never uploaded — and the signature is displayed but not verified.
Decoding happens entirely in your browser — the token never leaves this page. The signature is notverified: this tool shows you what a token claims, not whether it's authentic.
How to Use JWT Decoder
Paste your JWT
Copy the token from your Authorization header, cookie, or log output and paste it into the input box. Remove any 'Bearer ' prefix.
Read the decoded panels
The header and payload appear instantly as formatted JSON, with the signature shown separately. Malformed tokens get a clear explanation of what's wrong.
Check the timestamps
Review the expiry badge and the iat, exp, and nbf claims converted to your local time to confirm whether the token is still valid.
About JWT Decoder
What's inside a JWT
A JSON Web Token is three base64url-encoded segments joined by dots. The header declares the signing algorithm and token type. The payload carries the claims — who the token is about (sub), who issued it (iss), who it's for (aud), and when it was issued and expires (iat, exp). The third segment is the cryptographic signature that lets a server verify the token wasn't tampered with. Because the first two segments are just encoded JSON, anyone can read them — which is exactly what this tool does, formatting each segment as pretty-printed JSON in its own panel.
Decoding is not verifying
This distinction matters enormously. Decoding a JWT only reverses the base64url encoding — it requires no secrets and proves nothing about authenticity. Verifying a JWT means checking the signature against the issuer's secret or public key, which is what your server must do before trusting any claim inside the token. This tool decodes only: it shows you what a token claims, not whether those claims are genuine. Never treat a decoded payload as trusted, and never build authentication logic that skips signature verification.
Debugging token problems fast
Most JWT bugs come down to a handful of causes you can spot in seconds once the payload is readable: the token expired (check the exp badge), the clock-sensitive nbf claim hasn't arrived yet, the aud doesn't match what your API expects, or the wrong signing algorithm appears in the header. The tool converts Unix timestamps to your local time and computes how long ago the token expired or how long it has left. Since everything runs client-side, pasting production tokens is safe — they never leave your browser or appear in any log.
Common uses for JWT Decoder
- Check why an API rejects your token by inspecting exp, aud, and iss claims
- Verify your auth server is issuing tokens with the roles and scopes you expect
- Translate exp and iat timestamps into human-readable local times
- Inspect the algorithm in the header when debugging signature mismatches
- Examine ID tokens from OAuth and OpenID Connect flows during integration work
Frequently Asked Questions
Is it safe to paste a real production token here?
Yes — decoding runs entirely in your browser with client-side JavaScript, and the token is never transmitted, stored, or logged. That said, treat live tokens carefully in general: anyone who obtains one can use it until it expires. Avoid pasting production tokens into tools that process them server-side, and rotate any token you suspect has leaked.
Why doesn't this tool verify the signature?
Verification requires the secret key (for HMAC algorithms) or the issuer's public key (for RSA and ECDSA), which a generic browser tool shouldn't ask you to paste. Displaying the signature without verifying it keeps the security model honest: this tool tells you what a token claims, and your server's JWT library — with proper key management — decides whether to believe it.
What do iat, exp, and nbf mean?
They're timestamp claims in Unix epoch seconds. iat is when the token was issued, exp is when it stops being valid, and nbf (not before) is the earliest moment it may be accepted. This tool converts all three to readable dates in your local timezone and shows a badge computing exactly how long until expiry — or how long ago it happened.
Why won't my token decode?
Check that you pasted the complete token: it needs exactly three segments separated by dots, and truncation is the most common culprit — especially when copying from logs that cut long lines. Also strip any 'Bearer ' prefix from an Authorization header. If a segment decodes but isn't valid JSON, the token may be encrypted (JWE) rather than a standard signed JWT.
Can I decode a JWT without knowing the secret?
Yes — the header and payload are only base64url-encoded, not encrypted, so no secret is needed to read them. This surprises many developers: anything you put in a JWT payload is readable by whoever holds the token. Never store passwords or sensitive personal data in claims. The secret is only needed to create or verify signatures, not to read contents.