JWT Decoder
Decode JWT header, payload and expiry at a glance.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe string used to represent claims between two parties — most commonly an access token or an ID token in an authentication flow. It has three dot-separated parts: a base64url-encoded header (algorithm and token type), a base64url-encoded payload (the actual claims, like user ID and expiry), and a signature that lets the issuer verify the token hasn't been tampered with.
How to decode a JWT
- 1Paste a JWT into the box — it decodes instantly as you type.
- 2Standard claims (iss, sub, aud, exp, iat, nbf) appear in a readable table with local times.
- 3The full header and payload are pretty-printed as JSON below.
- 4The signature is shown as-is — it can't be verified here, only by the issuer.
Decoding vs. verifying
Decoding a JWT just reads the base64url-encoded header and payload — anyone can do this without any secret, which is why JWTs should never contain sensitive data in plain form. Verifying a JWT is different: it checks the signature against the issuer's secret (HMAC algorithms) or public key (RSA/ECDSA algorithms) to confirm the token is genuine and unmodified. This tool only decodes — verification requires a key this page never has access to.
Frequently asked questions
›Can this tool verify my JWT's signature?
No, and no browser-based tool safely can — verification requires the issuer's secret or public key. Sharing that key with a website would defeat its purpose. Verify tokens server-side, where the key is kept secret.
›Is it safe to paste a real access token here?
The token is decoded entirely client-side and never sent over the network — you can check the Network tab to confirm. That said, treat any real token as sensitive and avoid pasting production secrets into any web tool as a general habit.
›What does 'exp' mean and what happens after it passes?
exp (expiration) is a Unix timestamp after which the token should be rejected by anything that verifies it. Most libraries and APIs will refuse an expired token even if its signature is still valid.
›Why do I see an error even though my token looks fine?
Common causes are extra whitespace or line breaks pasted along with the token, a token that's missing one of its three dot-separated parts, or a payload that isn't valid JSON once decoded (some non-standard tokens use different encodings).
›What's the difference between iat, nbf and exp?
iat (issued at) is when the token was created. nbf (not before) is the earliest time it becomes valid, if set. exp (expiration) is when it stops being valid. All three are Unix timestamps in seconds.