Loading…
Decode a JSON Web Token to inspect its header, payload, and claims. Timestamps are shown as readable dates and expiry is checked instantly — all in your browser.
This JWT decoder splits a JSON Web Token into its three parts — header, payload, and signature — and shows you exactly what is inside. Paste a token and you immediately see the signing algorithm, every claim it carries, and whether it has expired. Registered claims like `iss`, `sub`, `aud`, `iat`, and `exp` are labelled, and the timestamp claims are converted from NumericDate seconds into readable ISO dates so you don't have to do epoch math in your head.
A JWT is not encrypted. The header and payload are just base64url-encoded JSON, which means anyone holding the token can read its contents — this tool does nothing you couldn't do by hand, it just does it faster. What protects a JWT is the signature, which proves the token was issued by someone holding the signing key and has not been altered since. That distinction matters: a decoded payload tells you what a token claims, never what is true.
For that reason this tool decodes but deliberately does not verify. Checking a signature requires the issuer's shared secret or public key, and pasting a signing secret into any web page — including this one — is a bad habit worth not forming. Verify tokens on your server with a real JWT library, and use this for the day-to-day work of debugging an auth flow: seeing why a token was rejected, confirming which scopes a service returned, or checking whether an expiry is what you configured. Everything runs in your browser, so tokens you paste are never uploaded or stored.
No. It decodes the token structurally but does not verify it, because verification requires the issuer's secret or public key. Always verify signatures server-side with a proper JWT library, and never paste a signing secret into a web page.
The decoding happens entirely in your browser — the token is never uploaded, logged, or stored. That said, a JWT is a live credential until it expires, so treat it like a password and prefer expired or test tokens when you can.
A JWT is signed, not encrypted. The header and payload are plain base64url-encoded JSON that anyone can decode. The signature only guarantees the token has not been tampered with; it does not hide the contents, so never put secrets in a JWT payload.
It compares the token's `exp` claim against your computer's current clock. If your system time is wrong the result will be too, and a server may still reject a token that looks valid here for other reasons, such as a failed signature check or a revoked session.
The most common causes are a truncated copy-paste, a missing segment, or stray whitespace and line breaks. A JWT must be exactly three dot-separated base64url segments, and the first two must each decode to a JSON object.