JWT Decoder

Inspect the header, payload and claims of a JSON Web Token — without handing it to a third party.

Runs on your deviceDeveloperWorkingNo account needed

What this tool does

A JWT is three base64url-encoded segments separated by dots: a header describing the signing algorithm, a payload of claims, and a signature. The first two are encoded, not encrypted — anyone holding the token can read them, which is exactly what this tool does.

The timestamp claims are where most debugging time goes, so they are rendered as absolute dates alongside the raw numbers. exp, iat and nbf are Unix seconds, and an off-by-1000 error (milliseconds where seconds were expected) is one of the most common causes of a token that is mysteriously always expired.

This tool does not verify the signature, and says so rather than implying more than it does. Verification requires the issuer's secret or public key, and a decoder that claimed to validate without one would be misleading. Treat everything shown here as unverified input.

How to use it

  1. Paste the token. The whole thing, including both dots. A leading "Bearer " is ignored, and any whitespace or line breaks inside the token are stripped before decoding.
  2. Read the header and payload. The algorithm and key id appear in the header; your claims in the payload.
  3. Check the timestamps. exp, iat and nbf are shown as dates, so an expired or not-yet-valid token is immediately obvious.
  4. Open the raw segments if you need them. The “Show the raw segments too” option prints the three base64url strings unchanged, for pasting elsewhere.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

Debugging a 401

Check whether the token is expired, issued for the wrong audience, or missing a scope the API requires.

Confirming a claim shape

Verify that the fields your backend expects are actually present, and spelled the way it expects them.

Reading someone else's token format

Understand what an identity provider issues before you write code against it.

Spotting a millisecond bug

A token whose exp is a thousand times too large or small shows up instantly when rendered as a date.

Questions

Is my token sent to a server?
No. Base64 decoding runs in this tab. That is deliberate — a JWT is a live credential, and pasting one into a server-side decoder means giving away working access for as long as it remains valid.
Does this verify the signature?
No, and it deliberately does not pretend to. Verification needs the issuer's secret or public key. Decoding only shows what the token claims; nothing here proves those claims are genuine.
Is a JWT encrypted?
Not usually. The standard JWTs you see are signed, not encrypted, so the payload is readable by anyone who holds the token. Never put anything secret in a JWT payload.
Why does my token fail to decode?
Usually it is truncated, or it is a different token format altogether. Whitespace and line breaks are stripped automatically, so wrapped tokens are fine. A five-segment token is a JWE — encrypted, and unreadable here without the decryption key.
Should I paste a production token here?
Decoding is local, so nothing is transmitted. Even so, treat live tokens carefully everywhere: prefer an expired or test token when you only need to inspect the shape.

Related tools