JWT Decoder
The JWT Decoder splits a JSON Web Token into its header and payload, decodes both from Base64URL, and displays every claim in a readable table — including converting iss, sub, aud, exp, iat and nbf into human dates where applicable. It flags immediately whether the token is currently expired based on its exp claim. This tool does not verify the token's signature; it only decodes and displays what the token already contains.
How it works
A JSON Web Token is just three Base64URL-encoded segments joined by dots: a header, a payload, and a signature. The header and payload are plain JSON underneath the encoding — no cryptographic key is needed to read them, only to verify that the signature over them is valid.
When you paste a token in, everything happens with JavaScript already loaded in the page. The token is split on its two dots, the header and payload segments are decoded from Base64URL back into JSON text, and that text is parsed and rendered as a table of claims. Standard claims get special handling: exp (expiration time), iat (issued at) and nbf (not before) are Unix timestamps in seconds, so each one is converted to a readable date, and the exp claim is compared against the current time to show a clear expired or valid flag at a glance.
This is decoding, not verification. Verifying a JWT means checking its signature against the secret or public key that issued it, which proves the token wasn't tampered with — and since we never see that key and never want to, we don't attempt it. A token can be perfectly well-formed and fully decodable while still being invalid, forged, or expired at the issuing server; treat the decoded output as a way to inspect a token's contents, not as proof it should be trusted.
Nothing about the token is transmitted anywhere. The decoding, parsing and expiry check all happen locally in your browser, and the token never leaves your device.
Frequently asked questions
Is it safe to paste a production JWT into this tool?
The decoding happens entirely in your browser and the token is never sent to any server, so pasting a token here is as safe as viewing it in your own browser console. Still, treat access tokens as secrets and avoid sharing decoded output that includes sensitive claims with others.
Why does the decoder show my token as expired when I just received it?
Check that the exp claim is in seconds, not milliseconds — some libraries generate it incorrectly — and confirm your system clock is accurate, since exp is compared against your local time.
Does this tool verify that the JWT signature is valid?
No. It only decodes the header and payload so you can read the claims; verifying the signature requires the issuer's secret or public key, which this tool never asks for or sees.
What's the difference between the header and payload in a JWT?
The header describes the token itself, typically the signing algorithm and token type. The payload carries the actual claims — the data about the user or session that the application cares about.
Why can I edit the claims and still see a valid-looking decoded token?
Decoding never checks the signature, so any well-formed Base64URL JSON will decode and display fine even if it's been tampered with. A server verifying the token by its signature would reject an edited payload immediately.