JWT Decoder
Paste a JWT (JSON Web Token) to see its header and payload formatted as JSON. Time-based claims such as exp iat nbf are also shown as human-readable dates. The signature is not verified, so this tool cannot confirm whether a token is authentic. The payload is just JSON, so for a closer look at the formatted result, also try the JSON Formatter tool.
🔒 Runs in your browser · Your data is never sent to a server
Notes
- This tool does not verify the signature. It only decodes the header and payload from Base64URL and displays them as JSON — it cannot confirm that a token was actually issued by a trusted source.
- A JWT payload can contain sensitive information. Everything runs entirely in your browser and the token you enter is never sent to a server, but still handle real production tokens with care.
- Time-based claims (
expiatnbfare interpreted as Unix seconds (seconds since January 1, 1970) and shown in your device's local time zone.
Glossary
JWT (JSON Web Token)
A token format that represents "claims" such as user info or permissions as JSON and attaches a digital signature. Commonly used as an authentication token after login or as an API access token. It is three parts — header, payload, and signature — joined by dots, each Base64URL-encoded.
Header
JSON describing the signing algorithm in use (`alg`, e.g. HS256, RS256) and the token type (`typ`, usually "JWT").
Payload
The JSON containing the actual data (claims) being carried. `sub` (subject), `iat` (issued at), `exp` (expiration), and `nbf` (not before) are "registered claims" with a defined meaning in the spec, but applications can also include their own custom claims.
Signature
A value used to verify that the header and payload have not been tampered with. It is computed using a secret or private key, so a third party without that key cannot produce a valid signature. This tool does not verify the signature — it only decodes the contents.
Base64URL
A variant of Base64 encoding where `+`, `/`, and `=` — characters that cause problems in URLs and filenames — are replaced with `-`, `_`, and omitted, respectively. Each segment of a JWT is encoded this way.
FAQ
Can this tool verify a JWT signature?
No. It only Base64URL-decodes the header and payload for display. It cannot tell you whether the token was issued by a legitimate party.
Is it safe to paste a production token?
Everything runs in your browser and the token is never sent anywhere. Payloads can still contain sensitive data, so be careful with real tokens and avoid showing them on shared screens.
Which time zone are exp and iat shown in?
Time claims are read as UNIX seconds and shown in your device's local time zone. Keep the offset in mind when comparing with UTC on the server.
Share this page