Decode and inspect JWT header and payload claims locally, including expiration, issued-at time, and algorithm metadata.
Quick answer: Paste a JSON Web Token and the header and payload decode instantly. The tool formats claims and interprets common timestamps without uploading the token.
Was this tool helpful?
Your vote is stored only in this browser and helps you remember whether the tool worked for your task.
Advertisement
How this jwt decoder helps
This JWT decoder inspects the header and payload of a JSON Web Token entirely in your browser. It splits the token, decodes Base64Url segments, formats the JSON claims, and highlights common fields such as alg, typ, iss, sub, aud, exp, iat, and nbf. Numeric timestamps are converted into readable UTC dates, and expired tokens are clearly labeled. This is helpful when debugging authentication flows, SSO integrations, API clients, mobile applications, and token refresh behavior. The tool intentionally does not verify signatures because that requires the issuer key or secret; instead, it explains that decoded claims must not be trusted until the token is validated by your application. Treat JWTs as sensitive credentials. This page never sends them to a server, and its local-only design reduces accidental exposure during troubleshooting.
Last updated: . All processing happens locally; no tool input is sent to a server.
Real-world examples
Check token expiration
Decode exp and see the UTC expiration time immediately.
Inspect an audience claim
Verify aud and iss values while debugging an API authorization failure.
Review signing metadata
Inspect alg and typ fields before checking your validation configuration.
Frequently asked questions
Does this JWT decoder verify signatures?
No. It decodes readable header and payload data only. Always verify the signature with the issuer key in application code.
Is it safe to paste a JWT online?
This tool processes the token locally and does not upload it. You should still avoid sharing active tokens and revoke credentials after exposure.
What do exp, iat, and nbf mean?
They are NumericDate claims: expiration time, issued-at time, and not-before time, expressed as seconds since the Unix epoch.
Why does my token fail to decode?
A JWT must have three Base64Url segments separated by dots. Missing padding, extra whitespace, or non-JSON segments can cause errors.