JWT Decoder
Decode and inspect JSON Web Tokens safely.
Runs in your browser — your text never leaves your device.
Save this tool
Keep JWT Decoder handy
Use your browser's Share menu, then “Add to Home Screen”.
Decoded, not verified. Checking a signature needs the issuer's key, which no in-browser tool has. This shows what the token says — never treat that as proof it is genuine.
Header
Payload
Claims
About this tool
A JSON Web Token packs three base64url-encoded parts into one string: a header describing the signing algorithm, a payload of claims, and a signature. The first two are merely encoded, not encrypted, so anyone holding a token can read everything inside it. This decoder shows both, translates the registered claims into readable labels, and converts the timestamp claims into real dates with a plain-language note such as expired three days ago or valid for another hour. One thing this tool deliberately does not do is tell you a token is valid. Verifying a signature requires the issuer's secret or public key, which no browser-based tool can have, so a token that decodes perfectly may still be forged or tampered with. Decoding happens entirely on your device, which matters here more than for most tools: a JWT is usually a live credential, and pasting one into a site that transmits it hands over an active session.
How to use it
- Paste your token, with or without the Bearer prefix
- Read the header, payload and decoded claims
- Check the expiry note to see whether it is still valid in time
Frequently asked questions
Does this verify the token's signature?
No, and no browser-based decoder can. Verification requires the issuer's secret or public key. This tool tells you what a token says, not whether it is genuine. Always verify signatures on your server before trusting a token's contents.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and nothing is transmitted, so this page never sees your token. That said, treat any JWT as a live credential: if it has not expired, anyone holding it can usually act as you, so avoid pasting production tokens into tools you have not verified are client-side.
Is the payload encrypted?
No. It is base64url encoded, which is trivially reversible and not a security measure at all. Never put passwords, card numbers or anything else sensitive in a JWT payload, because every holder of the token can read it.
What do exp, iat and nbf mean?
They are registered time claims measured in seconds since 1970. exp is when the token stops being valid, iat is when it was issued, and nbf is the earliest moment it may be used. This tool converts all three into real dates and tells you how long ago or how far ahead they fall.
Why does my token fail to decode?
Most often because it is not actually a JWT, or because a copy-paste picked up whitespace or truncated it. A JWT has exactly three parts separated by dots. If you see a different count, the string is incomplete or is a different token format entirely.