JWT Decoder

Decode and inspect the header and payload of a JSON Web Token. Decoded locally — nothing is sent to a server.

Paste a JWT

What is a JWT?

A JSON Web Token (JWT) is a compact token used for authentication and passing claims between systems. It has three parts separated by dots: header.payload.signature. The header and payload are Base64url-encoded JSON — not encrypted — so anyone can read them. The signature lets a server verify the token has not been tampered with.

Example

The payload of a typical token might contain claims like sub (subject/user id), iat (issued-at time), and exp (expiry time). This decoder converts the Unix timestamps in iat, exp, and nbf into readable dates and warns you if the token has expired.

Common claims

iss — issuer sub — subject aud — audience
exp — expiration time nbf — not valid before iat — issued at
jti — unique token id

Important: decoding is not verifying

This tool decodes the token so you can read it. It does not verify the signature, because verification requires the secret or public key. A decoded token tells you what it claims — never trust those claims without server-side verification.

Limitations

Signature is displayed but not checked. Use a signature verifier with the correct key for real validation (on our roadmap).
Encrypted tokens (JWE) are not plain Base64url JSON and will not decode here.
Expiry is compared against your device’s clock, so an incorrect local time affects the result.

How to fix common problems

“Not a valid JWT”: a JWT must have exactly two dots. Make sure you copied the whole token with no spaces or line breaks.
Payload looks garbled: the token may be a JWE (encrypted) rather than a JWS (signed) token.
Expired unexpectedly: check that your computer’s clock and time zone are correct.

Privacy: Your token is decoded entirely in your browser. Avoid pasting production tokens that are still valid.