JWT Decoder
Decode a JSON Web Token to read its header and payload, with exp, iat and nbf shown as readable dates and an expiry check. In-browser; the signature is not verified.
This tool decodes the token — it does not verify the signature, so it cannot tell you whether a token is authentic or has been tampered with. The payload of an unencrypted JWT is only Base64URL-encoded, not encrypted, so never put secrets in it. Decoding happens entirely in your browser; the token is never sent anywhere.
Reading a JWT: what is inside, and what it proves
A JSON Web Token packs three pieces into one dot-separated string: a header naming the signing algorithm, a payload of claims, and a signature. The header and payload are JSON objects that have been Base64URL-encoded — not encrypted — so anyone holding the token can read them. This tool splits the token, decodes those two parts, and pretty-prints the JSON.
Decoding is not verification. The signature is what makes a JWT trustworthy: it is computed over the header and payload with a secret (HMAC) or a private key (RSA/ECDSA), and only a party with the matching key can confirm it. This tool shows the signature but does not check it, because doing so safely requires the key and belongs on your server. A decoded payload tells you what a token claims about a user or session, never whether those claims are genuine.
The registered time claims are worth knowing. "iat" (issued-at), "nbf" (not-before) and "exp" (expiry) are all Unix timestamps in seconds. This tool renders each as an ISO date and flags whether the token is expired or not yet valid against your device clock — so a wrong local clock can make a good token look bad. Other common claims include "iss" (issuer), "sub" (subject) and "aud" (audience).
Because the payload is readable by design, never store passwords, API keys, full card numbers or other secrets in it. Keep tokens short-lived, refresh them server-side, and prefer inspecting tokens from development or staging rather than production. If you genuinely need the contents hidden in transit, that is a JWE (encrypted JWT), a five-part format that requires a key to open.
All decoding runs locally with the browser’s atob and TextDecoder. The token is not logged, stored or transmitted, and the tool works offline.
Key formulas (reference)
token = base64url(header) "." base64url(payload) "." base64url(signature) decode a part: atob( part.replace(/-/g,"+").replace(/_/g,"/") + padding ) → UTF-8 JSON expired? Date.now()/1000 > payload.exp
Related tools
These free tools pair well with this page — open them in a new tab to finish your workflow.
Frequently Asked Questions
What is a JSON Web Token?
A JWT is a compact, URL-safe token made of three Base64URL-encoded parts separated by dots: a header (which algorithm signed it), a payload (the claims — data about the user or session), and a signature. It is widely used for stateless authentication and for passing verified information between services.
Does this tool verify the signature?
No. It decodes the token so you can read what is inside, but it does not check the signature against a secret or public key. A decoded payload tells you what the token claims, not whether those claims are trustworthy. Signature verification must happen on a server with the signing key.
Is the payload encrypted?
Not in a standard signed JWT (JWS). The payload is only Base64URL-encoded, which anyone can reverse — this tool does exactly that. Never put passwords, API keys or other secrets in a JWT payload. If you need the contents hidden, you need an encrypted JWT (JWE), which is a different format.
What do the exp, iat and nbf claims mean?
"iat" is issued-at, "exp" is the expiry time, and "nbf" is not-before. All three are Unix timestamps in seconds. This tool converts them to readable dates and flags whether the token is currently expired or not yet active.
Why does my token show as expired?
The "exp" claim is earlier than the current time on your device. Tokens are meant to be short-lived; an expired one should be refreshed. Check that your computer’s clock is correct — a wrong local clock can make a valid token look expired or vice versa.
Is my token sent to your server?
No. Decoding happens entirely in your browser with atob and TextDecoder. Nothing is logged or transmitted, so it is safe to inspect tokens from a staging environment. Still, avoid pasting production tokens into any online tool as a matter of habit.
Can I decode an opaque or encrypted token?
Only tokens with the three-part header.payload.signature structure can be decoded here. Opaque session tokens (random strings) carry no readable data, and encrypted JWEs have five parts and require a key to decrypt.