About JWT Decoder
JWT Decoder splits a JSON Web Token into its three parts — header, payload, and signature — and decodes the header and payload back into readable JSON, entirely in your browser. A JWT is three base64url-encoded segments joined by dots: a header describing the signing algorithm, a payload carrying the claims (like user id, roles, or an expiry time), and a signature that lets a server verify the first two haven't been tampered with. This tool only decodes — it does not and cannot verify the signature, since that requires the issuer's secret or public key, which never leaves the server. Nothing you paste is uploaded, logged, or stored anywhere.
How to use it
- 1
Paste the token
Paste a full JWT (header.payload.signature) into the input pane.
- 2
Click Decode
The header and payload are decoded from base64url and parsed as JSON; the signature is shown as-is since it can't be decoded without the signing key.
- 3
Check expiry
If the payload has an exp claim, the terminal pane shows whether the token is expired or how long it remains valid.
What it does
- Splits a JWT into header, payload, and signature segments
- Decodes the header and payload from base64url and pretty-prints them as JSON
- Reads standard time claims (iat, nbf, exp) and reports expiry status
- Leaves the signature encoded, since verifying it requires a secret or key this tool never has
FAQ
Does this tool verify the JWT's signature?
No. Verifying a signature requires the issuer's secret (HMAC algorithms) or public key (RSA/ECDSA algorithms), neither of which this tool has or asks for. It only decodes the header and payload so you can read the claims — it doesn't tell you whether the token is authentic.
Is it safe to paste a production JWT here?
Decoding happens entirely in your browser and the token is never sent anywhere, so pasting it here doesn't expose it over the network. That said, a JWT's payload is only base64url-encoded, not encrypted — anyone who has the token can already read its claims, which is worth keeping in mind before sharing tokens with claims you consider sensitive.
Why does the payload show numbers instead of dates for exp, iat, and nbf?
Those claims are defined by the JWT spec as Unix timestamps (seconds since epoch), so that's how they're stored in the token. This tool reads them and reports expiry status separately in the terminal pane, but leaves the decoded JSON exactly as the token encodes it.
What does 'invalid JWT' mean here?
It means the input isn't three dot-separated segments, or one of the header/payload segments isn't valid base64url-encoded JSON. A truncated token, a stray space, or pasting something that isn't a JWT at all will all produce this error.