JWT Decoder
Paste a JSON Web Token to instantly decode its header and payload and read every claim. Expiry and issued-at timestamps are shown as readable dates, and because this is a decoder only, no secret is ever required — it all runs in your browser.
Header algorithm & type
Payload claims
Signature
Not verified — this tool decodes only and never sees your secret key.
What a JSON Web Token contains
A JWT is a compact, URL-safe way to carry claims between two parties. It has three parts separated by dots: a header declaring the signing algorithm and token type, a payload of claims (the actual data, such as who the token is for and when it expires), and a signature that ties the first two together. Each part is Base64URL-encoded, which is why a raw token looks like random text until it is decoded.
Reading the standard time claims
Several claims are registered and appear in most tokens: iat
(issued-at), exp (expiration), and nbf (not-before)
are Unix timestamps in seconds. This decoder converts them to your local time
and flags an expired token, so you can quickly tell whether an access problem
is simply a stale token rather than a permissions issue.
Decoding is not the same as verifying
Anyone can decode a JWT — the payload is only encoded, not encrypted. Security comes from the signature, which your server checks with the secret or public key. This tool intentionally stops at decoding so it never needs your key, and nothing you paste is uploaded. Use it to inspect and debug tokens, not to establish that one is authentic.
Frequently asked questions
How do I decode a JWT?
Paste the token — the long string that usually starts with "eyJ" — into the box and its three parts are decoded instantly: the header, the payload of claims, and the signature. Both the header and payload are pretty-printed as JSON so you can read every field at a glance.
Does this verify the JWT signature?
No — and that is deliberate. Verifying a signature requires the secret or public key, and this tool never asks for it, so nothing sensitive is entered. It decodes the token for inspection only. Never trust a decoded token as authentic until your backend has verified its signature.
What do the exp, iat, and nbf claims mean?
They are timestamps in seconds since 1970 (Unix time): iat is when the token was issued, exp is when it expires, and nbf ("not before") is the earliest time it is valid. This decoder converts each one into a readable date and tells you whether the token is currently expired.
Is it safe to paste a JWT here?
Decoding happens entirely in your browser with no network requests, so the token never leaves your device. That said, a JWT often grants access, so treat it like a password: only paste tokens you control, and be aware anyone with the token can decode the same claims you see here.
Why is my token showing as invalid?
A JWT must have three sections separated by dots (header.payload.signature). Common problems are a copied fragment, extra whitespace or quotes, or a "Bearer " prefix left in front. Remove any wrapping text so the token begins with the header segment and try again.
What is inside a JWT?
A JWT has three Base64URL-encoded parts. The header names the signing algorithm (like HS256 or RS256) and token type. The payload holds claims — data such as the subject, roles, and expiry. The signature is computed from the first two parts plus a secret, and is what verification checks. To decode Base64 on its own, use our Base64 decoder.