In short: A JWT decoder splits a JSON Web Token into its Base64URL-encoded header, payload and signature and shows the claims — such as sub, iat and exp — as readable JSON; decoding does not verify the signature.
About JWT Decoder
A JSON Web Token is three Base64URL-encoded parts joined by dots: a header that names the signing algorithm, a payload of claims such as the user ID and expiry, and a signature. The first two parts are just encoded JSON, which means you can read them without any key — handy when you are debugging an auth flow and need to know what is actually inside a token.
This decoder splits the token, decodes the header and payload, pretty-prints them, and translates the standard time claims (exp, iat, nbf) into readable dates in your time zone, including whether the token has already expired. Because tokens often grant access to real accounts, decoding happens entirely in your browser and nothing is logged or sent.
How to use JWT Decoder
- Copy the token, for example from an
Authorization: Bearer …header or your browser’s storage. - Paste it into the box. A leading
Bearerprefix is removed automatically. - Read the header and payload panels, and check the status line to see whether the token is currently valid by time.
- Look at the claims table for the meaning of standard fields like
sub,audandiss.
Examples
Decoding shows "exp": 1767225600, which the tool converts to 1 January 2026 00:00 UTC and marks as expired. The client needs to refresh its token.
The payload contains "aud": "api.example.com". If your service expects a different audience, the server will reject the token even though it is well-formed.
Frequently asked questions
Is it safe to paste a production token here?
The token is decoded in your browser and never transmitted, so this page does not expose it. Still, treat live tokens like passwords: avoid sharing screenshots of them and prefer short-lived test tokens when you can.
Why doesn’t this verify the signature?
Verification needs the secret (for HS256) or the issuer’s public key (for RS256/ES256) and must be done by the service that trusts the token. A browser tool decoding an untrusted token cannot tell you whether it is genuine.
What do exp, iat and nbf mean?
exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. All are Unix timestamps in seconds.
Can it decode encrypted JWTs (JWE)?
No. A JWE has five parts and its payload is encrypted, so it cannot be read without the decryption key. This tool handles signed tokens (JWS), which are the common kind.
Updated November 2026 · Free, no signup · How we build and test tools