JWT Decoder
Paste a JSON Web Token to read its header and payload as formatted JSON, with the exp, iat and nbf claims turned into readable dates and an expired or valid status. This is a decoder, not a verifier: it does not check the signature, and the token stays in your browser instead of being sent to a server.
Decoded only. The signature is NOT verified.
This tool reads what is inside a token; it cannot tell you whether the token is genuine or has been tampered with. The token stays in your browser and is never sent anywhere, but avoid pasting live production tokens into any online tool. Use a short-lived or test token where you can.
Why This Tool Matters
Most JWT problems start with a question that is quick to answer once you can see inside the token. Why did this request return 401: did the token expire, or is the nbf claim in the future because the two servers disagree about the time? Which scopes or roles did the identity provider actually put in the payload? Is the audience the one the API expects? Reading the claims takes a few seconds with a decoder and saves guessing from log lines.
A decoder also shows why a JWT is not a place for secrets. The payload is only encoded, not encrypted, so anyone holding the token can read it, exactly as this page does. That is also why the warning matters: a live production token is a credential. Prefer a test or expired token here, and never treat a decoded payload as proof the token is genuine, because only checking the signature with the right key does that.
How to Use
- 01
Paste the token
A leading “Bearer ” and stray spaces or line breaks are removed for you.
- 02
Read the decoded parts
The header and payload appear as formatted JSON, with the time claims shown in your local time and UTC.
- 03
Check the status and copy
See whether the token is expired, not yet valid or within its dates, then copy the header or payload.
More Text Tools
Frequently Asked Questions
What is a JWT?
A JSON Web Token is a compact string used to pass claims between systems, most often to prove who a user is after they sign in. It has three parts separated by dots: a header, a payload and a signature, each encoded with base64url. Servers hand them out as access or ID tokens, and clients send them back in an Authorization header.
What are the header, payload and signature?
The header describes the token, usually its type and the signing algorithm (alg). The payload holds the claims, such as sub for the subject, exp for the expiry time and any custom data. The signature is computed from the first two parts with a secret or private key, which is how a server can tell the token was not changed.
Does decoding a JWT verify it?
No. Decoding only reverses the encoding, which anyone can do, while verifying means recomputing the signature with the right key and comparing it. This tool shows the signature segment as it is and never checks it, so a token can decode fine and still be forged, tampered with or revoked. Do the verification in your server code with a trusted library.
Can this tool create, sign or encode a JWT?
No, it only decodes. It cannot build a token, sign one or edit a payload and re-sign it, and it will not accept an encrypted JWE token, which has five segments instead of three. Decoding in the browser is a one-way reading aid.
Is it safe to paste a real token here?
The token is decoded by JavaScript in your browser and is never sent to a server, but a live production token is still a credential and you should avoid pasting one into any online tool. Browser extensions, shared screens and clipboard history can all expose it. Use a test token, or one that has already expired, wherever possible.
How are exp, iat and nbf turned into dates?
They are numbers of seconds since 1 January 1970 UTC. The tool converts each to your local time zone and to UTC, then compares exp and nbf with your device clock to say whether the token is expired, not yet valid or within its dates. If your clock is wrong, the status will be wrong too.