JWT Decoder
Decode a JSON Web Token's header and payload instantly in your browser, with issue/expiry times shown as human-readable dates. This is a decoder, not a verifier — it never checks the signature against a key.
Decode, Not Verify
Reads the header and payload only. Signature verification is intentionally out of scope, so it's never claimed.
Human-Readable Timestamps
iat, exp, and nbf claims are shown as real dates, with expired tokens flagged clearly.
Local Processing
Your token never leaves your browser. Privacy first decoding.
How to Decode a JWT
- Paste the token — straight from an Authorization header is fine, a leading "Bearer " prefix is stripped automatically.
- Click Decode.
- Read the three panes: Header (algorithm and type), Payload (the claims), and Signature (shown as-is, never verified).
- Check the timestamp bar above the panes — iat, nbf, and exp claims are converted to human-readable dates, with expired tokens flagged.
Example: Reading a Token’s Claims
Input — JWT (header.payload.signature)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTg0MTIiLCJuYW1lIjoiUHJpeWEgU2hhcm1hIiwiaWF0IjoxNzUxMzU1ODQwLCJleHAiOjE3ODI4OTE4NDB9.k7VuVYnMxY0aBQCsLZgLnc0mPd0BFO1AlG3KxlXITEo
Payload pane shows
{
"sub": "user-8412",
"name": "Priya Sharma",
"iat": 1751355840,
"exp": 1782891840
}This sample’s exp claim resolves to July 1, 2026 — already in the past, so the decoder flags the token as Expired. That’s the single most common answer to "why did my API start returning 401?"
What the three segments actually are
A JWT is three Base64url-encoded segments joined by dots: a JSON header naming the signing algorithm, a JSON payload carrying the claims, and a binary signature over the first two. The first two are merely encoded, not encrypted — anyone holding the token can read them, which is exactly what this tool does.
Decoding is not verification
Reading a token tells you what it claims, not whether those claims are trustworthy — that requires checking the signature against the issuer’s key, which deliberately isn’t done here (your tokens never leave the browser, and no key material is ever requested). Never treat a merely-decoded token as authenticated input on a server.
Frequently Asked Questions
No, and it never will — this is a decoder, not a verifier. It reads the header and payload (both are just base64url-encoded JSON, no secret required) and shows you the signature segment as-is, but it makes no attempt to check that signature against any key or algorithm. Verifying a signature requires the secret or public key the token was signed with, which is not something a client-side tool should ever ask you to paste in.
The token itself never leaves your browser — there are no network calls, so nothing is sent anywhere. That said, decoding a live credential still means displaying it in plain text on your screen, so the usual precautions apply regardless of which tool you use: don't do this on a shared or untrusted machine, and be mindful of screen-sharing during a debugging session.
The exp, iat, and nbf claims are stored in the token as UTC Unix timestamps (seconds since the epoch), but this tool formats them using your browser's local timezone for readability, since that's usually what you actually want when checking "has this expired yet." If you need the raw UTC value, the underlying number is unchanged — only the display is localized.
Those claims are all optional per the JWT spec, so the tool simply omits whatever is missing — no error, no placeholder. A token with no exp claim, for example, is treated as non-expiring rather than flagged as invalid.
Yes — a leading "Bearer " prefix is detected and stripped automatically before decoding, since copying the full header value (rather than trimming it manually first) is the most common way people actually get a JWT to paste.
Related Tools
JSON Formatter
Make messy, minified JSON readable with customizable indentation.
JSON Validator
Check JSON validity with precise line/column errors.
Base64 Decoder
Decode Base64 text back to readable Unicode instantly.
URL Encoder
Safely percent-encode text for use in URLs and query strings.
JSON to YAML
Convert JSON documents to clean, indented YAML.
JSON to XML
Convert JSON into well-formed XML markup.