Toolsel

JWT Decoder

Runs in your browser

Decode a JSON Web Token and inspect its header, payload and expiry.

Token

What is a JWT Decoder?

A JSON Web Token is three Base64url-encoded segments joined by dots: a header describing the signing algorithm, a payload carrying the claims, and a signature. The first two segments are encoded, not encrypted — anyone holding the token can read them. A JWT decoder simply performs that decoding and pretty-prints the result.

Decoding is not verification. This tool shows you what a token claims; it does not check whether the signature is genuine, because doing so requires the issuer's secret or public key. A token with a forged payload and a broken signature decodes exactly as cleanly as a valid one. Signature verification belongs on your server, never in a browser tool.

Because the payload is readable by anyone who intercepts it, a JWT should never carry passwords, full payment details or anything else you would not put in a log line.

How to use it

  1. Paste the token into the input box. A leading "Bearer " prefix is stripped automatically, so you can paste straight from an Authorization header.
  2. The header and payload decode as you type. No button to press.
  3. Check the Expiry panel: it converts the numeric exp, iat and nbf claims into readable dates and tells you whether the token is currently valid.
  4. Read the standard claims — iss (issuer), sub (subject), aud (audience), jti (token ID) — alongside any custom claims your application added.

Example

A decoded payload

Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImlhdCI6MTUxNjIzOTAyMn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "iat": 1516239022
}

Frequently asked questions

Is it safe to paste a real access token here?
Decoding happens entirely in your browser — the token is never sent over the network, logged or stored. That said, treat any live token as a password: prefer an expired or test token when you can, and rotate anything you have pasted into a tool you do not control.
Does this verify the signature?
No, and no browser tool can do so safely. Verification requires the signing secret or public key, and pasting a signing secret into a website would hand over the ability to mint valid tokens. Verify on your server with a maintained JWT library.
Why can anyone read my JWT payload?
Base64url is an encoding, not encryption. It exists to make binary-safe text, not to conceal it. The signature guarantees the payload has not been altered; it does not hide the payload. If you need confidentiality, use JWE or simply do not put the data in the token.
What do exp, iat and nbf mean?
They are timestamps in seconds since the Unix epoch. exp is when the token expires, iat is when it was issued, and nbf (not before) is the earliest time it may be accepted. This tool renders all three as local dates.
My token will not decode. What is wrong?
Check that you copied all three dot-separated segments — truncation during copy is the most common cause. Also confirm you have a JWT and not an opaque session token, which is a random string with no internal structure and nothing to decode.