JWT Decoder
Decode a JSON Web Token's header, payload, and signature segment in your browser. Read standard claims like exp, iat, and aud in both local and UTC time. This tool does not verify signatures.
Free to use · Runs in your browser · No account required
Processed locally in your browser
Nothing you enter here is uploaded, transmitted to a server, or stored by this tool. Avoid pasting production tokens, even though decoding happens locally and nothing is uploaded.
Runs entirely in your browser — nothing is sent to a server
Decoding does not verify a token's signature or prove that the token is trustworthy.
Avoid pasting production tokens. Processing happens locally in your browser and the token is not uploaded by this tool.
No token decoded yet
Paste a JWT above and it decodes automatically, or load the example.
How to use this tool
- 1Paste a JWT (three dot-separated segments) into the field, or load the example token.
- 2The header and payload decode automatically — copy either one as formatted JSON.
- 3Timestamp claims (iat, nbf, exp) are converted to both your local time zone and UTC.
- 4Check the expiry banner if it appears — it tells you whether exp has already passed.
How a JWT is structured
A JSON Web Token is three Base64URL-encoded segments joined by dots: header.payload.signature. The header typically names the signing algorithm (alg) and token type. The payload carries claims — some standardized (iss, sub, aud, exp, nbf, iat, jti), others application-specific.
Decoding is not verification. Anyone can decode a JWT's header and payload — they are encoded, not encrypted. Proving the token is authentic requires checking the signature against the issuer's public key or shared secret, which this tool intentionally does not do: it never asks for a signing key and never claims a token is valid.
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes the header and payload segments so you can read the claims. Verifying a signature requires the signing key or secret, which this tool never asks for.
Is it safe to paste a real token?
Decoding runs entirely in your browser and the token is never sent over the network or stored, but as a general practice avoid pasting production tokens on shared or untrusted devices.
Why do exp and iat show two different times?
JWT timestamp claims are Unix seconds. This tool converts them to both your local time zone and UTC so you can compare against server logs.
Related writing
- JWT authentication without mythology — rotations, revocation, and session ergonomicsSymmetric versus asymmetric verification, JWKS fleets, leaky storage pitfalls, and when opaque cookies outperform bearer tokens.
- Hashing vs Encryption vs Encoding — The Differences Developers Must UnderstandA production-minded map of encoding, hashing, and encryption—salts, passwords, JWTs, Base64 myths, interview answers, and the mistakes reviewers catch.
Planned — not yet published
- PlannedHow JWT signature verification actually works (and why decoding isn't enough)— HS256 vs RS256 verification paths with code.
- PlannedWhat to put in a JWT payload — and what never belongs there— Claim design guidance grounded in real incident patterns.
- PlannedDebugging "jwt expired" and "invalid signature" errors— A checklist for the most common auth-integration failures.
Related tools
- Encoding
Base64 Encoder & Decoder
Encode UTF-8 text to Base64 or Base64URL, and decode it back safely.
- Data formatting
JSON Formatter & Validator
Format, minify, and validate JSON with clear syntax-error locations.
- Configuration
Environment File Validator
Check .env content for duplicate keys, malformed lines, and missing values.