JWT Decoder

Paste a JWT token to inspect its header, payload, and signature. Timestamps are auto-converted to readable dates.

JWT Token

Header

Payload

Signature

This tool only decodes the token client-side. It does NOT verify the signature.

Features

Show Header / Payload / Signature

Parse timestamps

Expiration check

Decode only (no verification)

How to Use

1. Paste your JWT token (the long string with two dots) into the input box.

2. The header, payload, and signature are decoded instantly on the right.

3. Expiration date is highlighted if the token has expired.

About this tool

A JSON Web Token has three Base64URL-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims such as the user ID and expiry time, and a signature. This decoder splits a token, decodes the header and payload into readable JSON, converts the iat, nbf and exp timestamps into dates, and tells you whether the token is expired, not yet valid or still within its lifetime. It is meant for debugging authentication — checking which claims an identity provider sends, why a session ends early, or which algorithm is in use. Decoding is not verification: anyone can read a JWT's payload, and only a server holding the right secret or public key can confirm the signature is genuine.

Frequently Asked Questions

Is it safe to paste a real token here?

The token is decoded in your browser and not sent to a server. Still, a valid access token works like a password until it expires, so avoid sharing production tokens anywhere, and prefer expired or test tokens for debugging.

Does this tool verify the signature?

No. Verifying requires the secret (for HS256) or the issuer's public key (for RS256 or ES256). Never trust the contents of a token in your application until it has been verified with a proper library.

What do iat, nbf and exp mean?

iat (issued at) is when the token was created, nbf (not before) is the earliest time it may be used, and exp (expiration) is when it stops being valid. All three are Unix timestamps in seconds.

Is the payload of a JWT encrypted?

A standard signed JWT (JWS) is only encoded, so anyone can read the payload. Do not put passwords or sensitive personal data in it. Encrypted tokens (JWE) have five parts and cannot be read without the key.

Why does decoding fail for my token?

The token may be incomplete, contain spaces or line breaks, include a "Bearer " prefix, or be an encrypted JWE with five segments. Paste only the three dot-separated parts of a signed JWT.