Developer tools / Security

JWT Decoder

Read a JSON Web Token's header, payload, timestamps, and signature section without uploading it anywhere.

Decoded locally in your browser

Encoded JWTToken decoded

Decoded token

Signature not verified

This tool only decodes the token. A readable JWT is not proof that its signature or claims are trustworthy.

Issued

Jul 25, 2025, 01:46:40 AM UTC

Expires

Jul 25, 2026, 01:46:40 AM UTC

Expired

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "role": "developer",
  "iat": 1753408000,
  "exp": 1784944000
}

Signature

demo-signature

Readable claims

Pretty-print header and payload JSON and turn Unix time claims into readable dates.

Expiration at a glance

Immediately see whether a token is expired, active, or has no expiration claim.

Safe expectations

Decoding is clearly separated from signature verification so readable data is never presented as trusted.

What this JWT decoder does

JWTs contain Base64URL-encoded sections that can be read without a secret key. This tool decodes those sections for debugging. It does not verify the cryptographic signature, issuer, audience, or any other security property. Always validate tokens in your application.

How to decode a JWT

1. Copy the complete token. A JWT normally has three dot-separated parts: header, payload, and signature.
2. Paste it into the decoder. The header and payload become readable JSON, while time claims are shown as dates.
3. Check the claims. Compare exp, iat, nbf, iss, and aud with what your application expects.

Common use cases

Use JWT decoding for diagnosis, not trust

Investigate a 401 response

Confirm whether an access token expired, is not active yet, or was issued for the wrong audience.

Check OAuth and OpenID Connect claims

Inspect the token shape during an identity-provider integration and compare the expected issuer, subject, and scopes.

Debug local development

Verify the claims a test environment produced before adding logs or pasting sensitive tokens into an issue tracker.

Explain token behavior to a team

Copy only the non-sensitive decoded fields into internal documentation to show why a session succeeded or failed.

JWT Decoder FAQ

Does decoding verify a JWT?

No. Anyone can Base64URL-decode a JWT header and payload. Verification requires checking the token signature and your application's issuer, audience, algorithm, and expiration rules.

Should I paste a production token here?

This tool processes the token locally, but a production token may still grant access if copied elsewhere. Prefer a short-lived test token whenever possible and revoke a token if you believe it was exposed.

Why does my token show an unexpected time?

JWT time claims are Unix timestamps in seconds. Check your server clock, time zone display, and whether the token's exp or nbf claim was generated in milliseconds by mistake.