JWT Decoder
Decode a JSON Web Token locally to read its header, payload and claims with readable dates. Decoding only — the signature is not verified.
Loading JWT Decoder…
About the JWT Decoder
JWT Decoder splits a JSON Web Token into its three parts and decodes the Base64URL-encoded header and payload into readable, pretty-printed JSON. Common claims — iss, sub, aud, iat, nbf, exp and jti — are listed separately, and timestamp claims are shown as local date and time alongside UTC and the original Unix value.
Decoding is not verification. This tool does not check the signature, does not know any secret or public key, and cannot tell whether a token is genuine or safe to trust. It only reports what the token says about itself, such as whether its exp claim is in the past according to your device clock. Everything runs in your browser.
How to use
- Paste a JWT (a “Bearer ” prefix is removed automatically).
- The header, payload and signature are decoded as you type, or click Decode.
- Review the claims summary, including readable dates for iat, nbf and exp.
- Copy the header, the payload or the full decoded summary, or download the summary.
- Click Reset to clear the token from the page.
Key features
- Local Base64URL and UTF-8 decoding of the header and payload.
- Pretty-printed JSON for both parts.
- Readable iss, sub, aud, iat, nbf, exp and jti claims.
- Timestamps shown as local time, UTC, relative time and the original Unix value.
- Clear errors for malformed tokens, invalid Base64URL, invalid JSON and encrypted JWE tokens.
- A prominent notice that the signature is not verified.
Best practices
- Verify tokens on your server with the correct key and algorithm — never trust a decoded token on its own.
- Use test or expired tokens when debugging, not live production tokens.
- Don’t put secrets or sensitive personal data in JWT payloads; anyone holding the token can read them.
- Check that iat, nbf and exp make sense, but rely on your server’s clock for decisions.
- Reject tokens with alg “none” in production systems.
Benefits
- Quick insight into what an auth token contains while debugging.
- Readable expiry times without converting Unix timestamps by hand.
- Nothing is sent over the network.
- Clear, honest warnings about what decoding does not prove.
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes the header and payload. It has no keys and does not check the signature, so it cannot tell whether a token is authentic.
Is it safe to paste a token here?
The token is decoded only in your browser and not sent anywhere. Still, treat live tokens like passwords and prefer test tokens when debugging.
Why does it say the token is expired?
The payload’s exp claim is earlier than your device’s current time. This is information only — the server that accepts the token makes the real decision.
Can it decode encrypted tokens (JWE)?
No. A JWE has five parts and its payload is encrypted, so it cannot be read without the decryption key.
What is Base64URL?
A URL-safe variant of Base64 that uses - and _ instead of + and / and usually omits = padding. JWT header and payload segments use it.
Why are dates shown in my local time?
iat, nbf and exp are Unix timestamps in seconds. The tool converts them to your local time and also shows UTC and the original number.