JWT Decoder
Decode a JSON Web Token's header and payload โ locally.
Inspecting a token
Paste a JWT and its three parts open up: header (algorithm and type), payload (the claims), and registered claims explained โ issuer, subject, audience, with iat/exp/nbf timestamps converted to readable dates. An expiry banner does the arithmetic against the clock: valid for another N hours, or expired N days ago, which answers the most common debugging question at a glance.
Everything decodes locally. Even so, treat pasted production tokens as compromised on principle โ debug with expired ones where possible.
Decoded is not verified โ the distinction that matters
A JWT is three Base64url segments, and Base64url is encoding, not encryption: anyone can read the header and payload, which is precisely what this page does. The security lives entirely in the third segment โ the signature โ which a server verifies with its key. This page has no key and verifies nothing, so "decodes cleanly" and "is genuine" are unrelated claims.
The corollaries that bite in production: never put secrets in a payload (users can read
their own tokens with exactly this page), never accept alg: none, and remember
expiry is enforced by the verifying server, not the token. The encoding itself is the
Base64 tool's subject, timestamps decode in the
Unix timestamp converter, and signing-versus-encrypting is laid
out in the hashing guide.
Frequently asked questions
Is it safe to paste a JWT here?
Decoding happens entirely in your browser with no network request. Still, standard hygiene: treat any shared production token as compromised, and prefer expired tokens for debugging.
Can this tell me if a token is valid?
It reads the expiry claim and does the date arithmetic, but it cannot verify the signature โ only the issuing server's key can prove the token is genuine and untampered.
Why can I read the payload without a key?
JWT payloads are Base64url-encoded, not encrypted โ readable by design. The signature proves integrity; it does not hide content. Never put secrets in claims.
What are iat, exp and nbf?
Issued-at, expiry and not-before โ Unix timestamps governing the token's window. This page converts them to readable dates and checks exp against the clock.