JWT Decoder
Decode a JSON Web Token to read its header and payload, with human-readable expiry — all in your browser.
About the JWT Decoder
The JWT Decoder takes a JSON Web Token — the long header.payload.signature string you get from an auth server, an API, or a browser cookie — and unpacks the first two parts into readable JSON. A JWT is not a random blob: its header and payload are just JSON objects that have been base64url-encoded and joined with dots. This tool splits the token, base64url-decodes each segment, and pretty-prints the result so you can see exactly which claims a token carries — the subject, the issuer, the scopes, and the timestamps that control when it is valid. Everything happens directly in your browser using the same atob decoder the browser ships with, so nothing you paste ever leaves your device.
Developers reach for a JWT decoder constantly while debugging authentication. When a request comes back 401, the fastest first check is often "what's actually inside the token I'm sending?" Decoding it reveals whether the exp has already passed, whether the aud matches the API you're calling, or whether a scope you expected is simply missing. Because the payload is human-readable, you can confirm the token's contents in seconds instead of guessing.
How to use
- Paste your JWT into the token box. It should be a single string of three parts separated by dots — for example
eyJhbGci….eyJzdWIm...….signature. - Read the decoded header on the left. This usually shows the signing algorithm (
alg) and token type (typ), plus a key id (kid) if one is present. - Read the decoded payload on the right. These are the claims — things like
sub,iss,aud,scope, and any custom fields the issuer added. - Check the timestamps. Any
iat,exp, ornbfclaims are shown both as their raw epoch seconds and as readable UTC and local dates, so you don't have to convert them by hand. - Read the validity indicator. The tool compares
expandnbfagainst your device clock and tells you whether the token is expired, not yet active, or within its valid window. - Copy the header or payload with the buttons, or hit Clear to start over. The raw signature is shown for reference but is intentionally not verified.
If the string isn't a well-formed JWT — it doesn't have three dot-separated parts, or a segment isn't valid base64url — you'll see an inline error explaining what's wrong instead of a broken result.
Frequently asked questions
Is my token uploaded or stored anywhere?
No. All splitting, base64url-decoding, and timestamp math happen locally in your browser with JavaScript. Your token is never sent to a server, saved, or logged. This matters a great deal for a token tool: a real JWT often grants access to an account, so you should only ever decode one somewhere it stays on your machine. Close the tab and it's gone.
Does decoding a JWT verify that it's genuine?
No — and this is the most important thing to understand. Decoding only reads the base64url content; it does not check the cryptographic signature. Verifying a token requires the signing secret (for HS256) or the issuer's public key (for RS256/ES256) and confirms the token wasn't tampered with. A token can decode perfectly and still be forged, altered, or expired. Never trust a decoded payload as proof of identity.
Are JWTs encrypted? Is it safe to share one?
Standard JWTs are encoded, not encrypted. Anyone who has the token can base64url-decode the payload and read every claim inside it — that's exactly what this tool does. Treat a JWT like a password: don't paste real production tokens into untrusted sites, and don't put secrets in the payload. (A separate standard, JWE, does encrypt the contents, but the common signed JWT does not.)
Why does it say my token is expired?
The tool reads the exp claim — a Unix timestamp in seconds — and compares it to your computer's clock. If your device clock is wrong, the result can be misleading. The nbf ("not before") claim works the same way in reverse: a token is not yet valid until that time passes.
What does the "signature not verified" note mean?
The third segment of the token is its signature. This tool displays it verbatim but makes no attempt to validate it, because doing so would require the secret or public key and knowledge of the alg. Use your backend or a dedicated library to verify signatures.
The tool won't decode my token — what's wrong?
A valid JWT has exactly three parts split by dots, each of which must be valid base64url. Common causes are a copy/paste that dropped a segment, extra surrounding quotes or whitespace, or a value that isn't actually a JWT (an opaque session token, for instance). Re-copy the full token and try again.