JWT Decoder
Decode and inspect a JSON Web Token — without uploading it.
Runs in your browser — nothing is uploaded
Anatomy of a JSON Web Token
A JWT is three Base64URL-encoded segments joined by dots: header.payload.signature. The header names the signing algorithm (alg) and token type (typ). The payload carries the claims, such as who the token is about (sub), who issued it (iss), who it is for (aud), and when it was issued (iat) or expires (exp). The signature proves the first two segments have not been altered.
The header and payload are only encoded, not encrypted, so anyone holding the token can read them. This decoder splits the token, decodes both segments from Base64URL and shows them as formatted JSON.
Reading the time claims
The exp, iat and nbf claims are Unix timestamps in seconds, not milliseconds. A token with exp 1700000000 expires at 22:13:20 UTC on 14 November 2023. Paste a claim value into the Unix timestamp converter to see it as a date, which is usually the quickest way to find out why a request is being rejected as expired.
Decoding is not verifying
Decoding tells you what a token says, not whether to believe it. Anyone can create a token with any payload; only checking the signature against the issuer's key proves it is genuine. Never make an authorisation decision from a decoded payload alone. To check a signature, use the JWT verifier.
Tokens are bearer credentials: whoever holds one can use it until it expires. That is why this decoder runs entirely in your browser and never sends the token anywhere.
Examples
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cOutput
{
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
}How to use
- Paste your JWT.
- Read the decoded header and payload.
FAQ
Does this verify the signature?
No. It decodes the header and payload for inspection. Signature verification requires the signing key and is a separate tool.
Is it safe to paste a production token here?
Decoding happens locally and the token is never uploaded. Still, treat live tokens like passwords: prefer expired or test tokens, and revoke any token you suspect has leaked.
Why do I get 'A JWT has three dot-separated parts'?
The input is not a complete JWT. Check that you copied the whole token, without a leading 'Bearer ' prefix or a missing segment. Encrypted tokens (JWE) have five parts and cannot be decoded without the key.