JWT Decoder
Decode the header and payload of a JSON Web Token and inspect its claims.
Decoded locally. The signature is never verified, so no secret is required.
About JWT Decoder
A JSON Web Token is three base64url-encoded segments joined by dots: a header describing the algorithm, a payload of claims, and a signature. The first two segments are encoded, not encrypted, so anyone holding the token can read them.
This decoder splits the token, decodes both segments and highlights the registered claims - issuer, subject, audience, expiry - converting timestamps into local dates and flagging tokens that have already expired.
How JWT Decoder works in your browser
A JSON Web Token is three Base64url-encoded segments joined by dots: header, payload, and signature. Decoding the first two is pure string work — the padding is restored, atob converts each segment to bytes, and those bytes are parsed as JSON. No key is needed for this, which is exactly why a JWT should never be treated as a secure container for anything you would not show the token holder.
Registered time claims are rendered as readable dates: exp (expiry), iat (issued at) and nbf (not before) are Unix timestamps in seconds, and comparing exp to the current time is usually the answer to "why is this request suddenly 401".
The signature is deliberately not verified. Verification requires the issuer’s secret or public key, and a tool that asked you to paste a signing secret into a web page would be asking for the one value that must never leave your infrastructure. Decoding tells you what a token claims; only your own backend can tell you whether to believe it.
When to use it
- Checking whether an access token has expired before assuming the API itself is broken.
- Confirming which scopes, roles or tenant id an identity provider actually issued, rather than what the documentation says it should.
- Comparing a token from staging against one from production when authentication works in one environment and not the other.
- Inspecting a synthetic or expired token while learning its structure. Avoid live credentials on public websites, even when decoding is local.
Frequently asked questions
How do I decode a JWT?
Paste the token. The header and payload are Base64url-encoded JSON and are decoded in your browser without a key, which is why a JWT should never carry anything you would not show the token holder.
Does this verify the signature?
No. Verification requires the signing secret or public key, and you should never paste a production secret into a web page. This tool decodes only.
Is my token uploaded for decoding?
The decoder runs locally and does not upload the token. This public page still uses third-party services. Use a synthetic or expired token, not a working production credential.
Why is my expiry shown as a date?
The exp, iat and nbf claims are NumericDate values - seconds since the Unix epoch - so they are rendered as readable dates for convenience.