About the JWT Decoder
A JWT is three Base64url parts separated by dots: a header naming the algorithm, a payload of claims, and a signature. This decoder splits the token, decodes the header and payload, and shows them as formatted JSON. Standard time claims are translated: exp, iat and nbf are shown as ISO timestamps with a note of whether they are past or future, and the status line flags an expired token.
The signature is shown but deliberately not verified. Verifying it requires the secret or public key, and doing that in a web page would mean sending the key somewhere. Decoding is safe and useful on its own: it answers "what does this token claim and when does it expire", which is what you usually need while debugging. Never trust a decoded token as proof of anything without server-side verification.
Because everything runs in your browser, it is safe to paste a real token; it is not transmitted or logged. A leading Bearer is stripped automatically. To decode a single Base64 value rather than a whole token, use Base64 Decode.
How to use
- Paste the JWT, with or without a Bearer prefix.
- Read the header and payload as JSON, and the times below.
- Check the status for whether the token has expired.
Common questions
- Does it verify the signature?
- No. Verification needs the signing key, which should never be pasted into a web page. This tool decodes only, which is safe.
- Is my token sent to a server?
- No. It is decoded in your browser. You can confirm in the network tab.
- Why does it say the token is expired?
- The exp claim is a time in the past. The token would be rejected by a server even though it decodes fine here.
- What algorithms are shown?
- The alg field from the header, such as HS256 or RS256. The tool reads it but does not use it, since it does not verify.