JWT Decoder
Decode a JWT header and payload into readable JSON with formatted dates for exp/iat/nbf, signature state and expiry status. Safe: verification never happens in the browser.
…
…
…
Security notes
A JWT has three Base64URL parts. This tool only decodes it: the signature is not verified (that requires the secret key or public key and must happen server-side), so a decoded token proves nothing by itself. alg = none is highlighted in red because it historically enabled trivial forgery. Claims exp, iat and nbf are rendered as dates; the expiry badge compares exp with your device clock.
How to use JWT Decoder
Paste the full token — all three dot-separated parts — and the header and payload decode into formatted JSON instantly, with standard claims (sub, iss, aud, exp) explained next to their values. The expiry claim is checked against your local clock, so an expired marker is immediately visible.
Decoding is not verification: the signature recomputes only with the secret key, so treat this tool as a reader, not a gate. Because everything runs in your browser, production-shaped tokens are safe to inspect — though a decoded payload is readable by anyone who holds the token, so distribute tokens accordingly.
Frequently asked questions
Does decoding a JWT verify it?
No. Decoding only base64-decodes the header and payload so humans can read claims such as sub, exp and iss. Signature verification requires the signing key and a crypto library.
Is it safe to paste a token here?
The tool runs entirely in your browser and nothing is transmitted. Still, treat tokens like passwords — a decoded payload is readable by anyone who holds the token string.
Why does the signature part look garbled?
The signature is raw bytes signed with HMAC or RSA and printed as base64. That is expected — meaningful inspection happens in the header and payload parts.
What does the exp claim mean?
exp is the Unix expiry timestamp. The decoder marks the token expired or unexpired against your local clock, which helps while debugging session lifetimes.