JWT Decoder
Read the header and claims inside a JSON Web Token.
Everything runs inside your browser. Your files never leave your device.
Input
Result
Ask about JWT Decoder
Questions about what this tool does, which option to pick, or what it can and cannot handle.
This is the one part of the site that uses a server. The question you type here is sent to an AI provider to be answered — your files and whatever you put in the tool above are not, and the assistant cannot see them. Answers are generated and can be wrong; the tool itself is not guessing.
About the JWT Decoder
A JSON Web Token is three Base64URL segments joined by dots: a header saying how it was signed, a payload of claims, and a signature. The first two are not encrypted — they are encoded, and anyone holding the token can read them. This decoder does exactly that, and shows the result as formatted JSON.
Most of the time you are here to answer one of three questions. What is in this token? Has it expired? Which algorithm signed it? The tool answers all three: the header and payload are printed side by side, the standard time claims are converted from Unix seconds to readable dates, and the expiry is compared with the current time so the status reads as expired or not expired at a glance.
What it deliberately does not do is verify the signature. Verification requires the issuer's secret or public key, and a page that asks you to paste a signing secret into it is a page you should not use. The signature is shown for completeness with a note saying it has not been checked. A decoded token proves nothing about authenticity — only a verified one does, and that verification belongs on your server.
The token never leaves your browser. Since tokens are credentials, that is not a nice-to-have.
How to use it
- 1Paste the token into the input box — a leading “Bearer ” is stripped automatically.
- 2Read the decoded header and payload below.
- 3Check the times section for when the token was issued and when it expires.
- 4Read the status figure to see whether it has already expired.
Questions
- Does this verify the signature?
- No, and deliberately so. Verifying requires the signing key, and you should never paste a signing secret into a web page. Decoding tells you what a token claims; only verification on your own server tells you whether to believe it.
- Is it safe to paste a real token here?
- The decoding happens entirely in your browser and nothing is transmitted or stored. That said, treat any credential you paste anywhere as one you might want to rotate later.
- What do exp, iat and nbf mean?
- Expiry, issued-at and not-valid-before, all as Unix timestamps in seconds. The tool converts each to a readable date so you do not have to.
- My token has only two segments. Is it broken?
- Not necessarily — an unsigned token uses the “none” algorithm and has an empty signature. It decodes fine here, but nothing vouches for its contents, and most systems rightly reject it.
- Can I edit the payload and re-sign it?
- No. Signing requires the secret, which this page never asks for and could not use safely if it did.