JWT Decoder
Decode a JWT's header and payload and read its claims — entirely in your browser.
The signature is shown but not verified — decoding happens entirely in your browser.
How to use the JWT Decoder
Paste your JWT (or click Sample to see one).
Read the decoded header and payload panels.
Check the registered-claims table for expiry and other standard fields.
What is a JWT, and what does decoding actually show you?
A JSON Web Token is three Base64url segments joined by dots — header.payload.signature. The header names the signing algorithm and token type (e.g. {"alg":"HS256","typ":"JWT"}); the payload carries the claims — the actual data, like a user ID and expiry; the signature is a cryptographic proof, computed over the header and payload with a secret or private key, that lets a server confirm the token hasn't been tampered with. This tool Base64url-decodes the header and payload so you can read them as JSON, and converts numeric-timestamp claims (exp, iat, nbf) into human-readable dates with a relative offset like "expires in 3 days". What it deliberately does not do is verify the signature — that requires the issuer's secret key, which never belongs in a client-side tool. A JWT with alg set to "none" and no signature at all is technically valid-looking JSON but represents a well-known token-forgery vector (CVE-class issue in several older libraries), which is one more reason decoding and verifying are different operations and should never be confused.
For a step-by-step walkthrough, read our guide: JWT Explained: Decoding JSON Web Tokens Without a Library.
Key features
- Decodes header and payload instantly as formatted JSON
- Converts exp, iat and nbf into human-readable dates with a relative offset
- Flags expired tokens at a glance
- Fully client-side — pasted tokens are never uploaded or logged
Frequently asked questions
Does this verify the JWT signature?
No — verifying requires the issuer's signing secret or public key, which this tool never asks for or has access to. It only decodes the header and payload for inspection.
Is it safe to paste a production token here?
Decoding happens entirely in your browser's JavaScript and nothing is transmitted — but treat live tokens as sensitive regardless of the tool, since anyone who has the raw token string can already read its payload (JWTs are encoded, not encrypted).
What do exp, iat and nbf actually mean?
exp is when the token expires, iat is when it was issued, and nbf ("not before") is the earliest time it becomes valid — all stored as Unix timestamps (seconds since 1970), which this tool converts to readable local dates.
Why does it say the token is expired even though I just generated it?
Sample/demo tokens often ship with a fixed exp far in the past. Check the claims table's expiry row — if it needs to be valid now, generate a fresh token from your auth service.