JWT Decoder
Decode JWT tokens to inspect header, payload and expiry. Decoding runs entirely in your browser — the token is never uploaded.
How to use
- Paste the JWT token into the input box — no button needed; the header and payload are decoded and pretty-printed instantly.
- The token is split on "." and each part is decoded as Base64URL (with "=" padding restored automatically), then shown as formatted JSON for easy reading of nested structures.
- The summary below lists alg / typ plus the local times for the iat (issued at), nbf (not before) and exp (expires) claims; exp also gets an "Expired / Valid" badge with the remaining time.
- The signature is shown as-is for comparison or copying only; this tool does not verify it and cannot prove the token is untampered.
- Click "Example" to generate a demo token, or "Clear" to remove the input and all results.
FAQ
Is my token uploaded to a server?
No. Splitting, Base64URL decoding and JSON formatting all run as local browser scripts — the token never leaves your device. Still, avoid pasting sensitive production tokens, since the decoded content is visible on screen.
Why does it say "Valid" but the server still rejects the token?
This tool only decodes the content and compares exp / nbf against your device clock. It does not verify the signature and does not check revocation, issuer (iss), audience (aud) or other server-side policies. Trustworthiness is always decided by the server's own validation.
Which token formats are supported?
Standard JWS three-part JWTs (header.payload.signature) are supported. Five-part JWE encrypted tokens carry encrypted content that cannot be decoded directly and produce a clear message; an empty signature with alg "none" is expected.
Which time zone is used for the times?
The exp / iat / nbf claims are Unix timestamps in seconds; the tool converts them to your browser's local time zone. Your server may run in a different zone, so keep that in mind when comparing.