JWT Decoder
Paste a JSON Web Token and instantly read its header, payload, and claims in plain, formatted JSON. The tool highlights standard claims like expiry and issued-at as human-readable dates and tells you whether the token has expired. Everything is decoded in your browser — your token is never sent anywhere.
How to Use
Paste your JWT into the box (or load the sample). The decoder splits it into its three parts, Base64URL-decodes the header and payload, and shows them as readable JSON. Standard time claims (exp, iat, nbf) are converted to dates, and an expiry banner tells you if the token is still valid.
Why This Tool Is Useful
JWTs are the backbone of modern authentication, but they're opaque strings you can't read at a glance. When debugging an API, a login flow, or a permissions bug, you often need to see exactly what's inside a token — which user it identifies, what scopes it carries, and when it expires. Pasting a token into a random website is risky, since JWTs can contain sensitive session data. This decoder runs 100% client-side, so the token never leaves your machine.
The Three Parts of a JWT
A JWT is three Base64URL-encoded segments separated by dots: header.payload.signature. The header says how the token is signed (for example HS256 or RS256). The payload holds the claims — the actual data. The signature is a cryptographic seal that proves the token wasn't tampered with.
Decoding is not the same as verifying. Anyone can decode the header and payload because they're just Base64 — only the signature check (which needs the secret or public key) proves the token is authentic. This tool decodes; it does not verify.
Understanding Expiry
The exp claim is a Unix timestamp for when the token stops being valid. This tool compares it to the current time and shows a clear expired / valid banner. The iat (issued at) and nbf (not before) claims are shown as dates too, so you can see the token's full lifetime at a glance.
Is It Safe to Decode Tokens Here?
Yes. The decoding happens entirely in your browser with JavaScript — there is no server call, no logging, and nothing is stored. That matters because a live JWT is effectively a password: if it leaks, someone can impersonate the user until it expires. Keep that in mind before pasting production tokens into any online tool.
Standard JWT Claims
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who created and signed the token |
| sub | Subject | Who the token is about (usually a user ID) |
| aud | Audience | Who the token is intended for |
| exp | Expiration | Time after which the token is invalid |
| nbf | Not before | Time before which the token is invalid |
| iat | Issued at | When the token was created |
| jti | JWT ID | A unique identifier for the token |