JWT decoder
Decode a JSON Web Token to read its header, payload and iat, nbf and exp dates, and see whether it has expired. Signatures are not verified. Runs locally.
About JWT decoder
The JWT decoder splits a JSON Web Token into its parts and shows the header and payload as formatted JSON. Paste a token from an Authorization header, a cookie or a login response, and you can immediately see the signing algorithm, issuer, subject, scopes and any custom claims.
Time claims are translated for you: iat, nbf and exp are converted from Unix seconds to ISO 8601 dates, and the decoder tells you whether the token has expired. The signature is not verified, so use the result to read a token, not to trust it. Decoding happens in your browser, which matters because tokens are credentials.
How to use JWT decoder
- Paste a token, usually starting with eyJ, into the input box.
- Read the decoded header and payload in the output box.
- Check the Claims section for the iat, nbf and exp dates and the expired or not expired status.
- Copy the decoded text if you need it for a bug report, removing sensitive values first.
Features
- Decodes the Base64URL-encoded header and payload of a three-part signed JWT.
- Shows both parts as indented JSON, including nested and custom claims.
- Converts iat, nbf and exp from Unix seconds to ISO 8601 dates in UTC.
- Compares exp with your device clock and reports expired or not expired.
- Marks the output with “Signature: not verified” so the result is not mistaken for validation.
Common uses
- Checking which scopes, roles or audience an access token carries while debugging an API.
- Finding out whether a 401 response is caused by an expired token.
- Inspecting ID tokens from an OpenID Connect login during an integration.
- Confirming the alg and kid values in a token header.
Frequently asked questions
Does decoding a JWT verify it?
No. Decoding only reads the Base64URL-encoded header and payload, which anyone can do without a key. Verification means checking the signature with the issuer’s secret or public key and validating claims such as exp, iss and aud. Your server must do that before trusting any claim.
Why can anyone read the payload of a JWT?
A signed JWT is encoded, not encrypted. The signature only proves that the content has not been changed. Never put passwords or other secrets in a JWT payload; if the claims must be confidential, the token needs to be encrypted as a JWE.
Can it decode encrypted JWTs (JWE)?
No. Encrypted tokens have five dot-separated parts, and their payload cannot be read without the decryption key. The decoder expects the three-part header.payload.signature format of a signed JWT and reports an error otherwise.
What do iat, nbf and exp mean?
They are registered claims holding Unix timestamps in seconds: iat is when the token was issued, nbf is the time before which it must not be accepted, and exp is when it expires. The decoder shows each as an ISO 8601 date in UTC.
Why does the decoder say “expired” when my app still accepts the token?
The status compares exp with your device’s clock. If the clock is wrong, or the server allows a few minutes of clock skew, the two can briefly disagree. A server that ignores exp entirely has a security bug worth fixing.
Is my input uploaded?
Tools run in your browser. Files, text and results are not uploaded to our servers and are cleared when you leave the tool.
Your privacy comes first
Tools run in your browser. Files, text and results are not uploaded to our servers and are cleared when you leave the tool.