JWT Decoder
Inspect the JSON header and payload of a JWT locally for debugging. The tool does not transmit the token or claim that it is authentic.
Runs locally in your browser
Decoded only. The signature is not verified, so do not trust claims based on this view alone.
Discuss a result
Write a short summary and review it before posting. Your tool inputs are never copied automatically.
What is the JWT Decoder?
Inspect the JSON header and payload of a JWT locally for debugging. The tool does not transmit the token or claim that it is authentic.
How to use it
- 1Paste a three-part JWT.
- 2Read the decoded header and payload.
- 3Clear the token when finished.
How it works
The first two Base64url parts are decoded as UTF-8 JSON. The third part is a signature and is left untouched.
Inspect an expiration claim
A payload containing “exp” can be read as JSON, then its Unix timestamp checked with the timestamp converter.
Limitations & notes
- Decoding does not verify the token signature.
- Do not treat the visible claims as trusted authorization data.
Frequently asked questions
Is it safe to paste a JWT into a website?
Only if the page decodes it locally. A JWT is a bearer credential: anyone holding a valid, unexpired token can often act as that user. This tool decodes the token in your browser with JavaScript and does not send it to a server. Even so, prefer test or expired tokens, avoid pasting production tokens on shared computers, and use the Clear token button when finished.
Is the data inside a JWT encrypted?
Usually not. A standard signed JWT (JWS) has three Base64url-encoded parts: header, payload and signature. Base64url is an encoding, not encryption, so anyone with the token can read its claims, as this tool shows. The signature only proves the content was not changed. Never put passwords or secrets in a JWT payload. Encrypted tokens (JWE) have five parts, which this tool does not decode.
How do I read the exp, iat and nbf claims?
These claims are NumericDate values: seconds since January 1, 1970 UTC. For example, exp: 1767225600 means the token expires at 2026-01-01 00:00:00 UTC. iat is when it was issued, and nbf is the earliest time it may be used. This tool shows the raw numbers without converting them or checking expiry, so paste them into a Unix timestamp converter to read them as dates.
Why does decoding a JWT not prove it is valid?
Decoding just reverses the Base64url encoding. Validation means checking the signature with the issuer's secret or public key, confirming the alg header is one you expect (rejecting none), and verifying exp, nbf, iss and aud. Anyone can create a token with any claims, such as role: admin. Your server must verify every token with a maintained JWT library before trusting it.
Why does the tool say it could not decode my token?
The tool needs exactly three dot-separated parts, and the first two must be Base64url-encoded JSON. Common causes are copying the Bearer prefix or quotes along with the token, a token cut off when copied from a log, an opaque access token that is not a JWT at all, or a five-part encrypted JWE. Remove extra characters and paste only the eyJ... string.
No directly related discussion yet.
Start a focused thread and share the question this tool helped you explore.
Ask the community about JWT Decoder