Developers
JWT Decoder
Header, payload, expiry — your JWT decoded in plain sight, without leaving your browser.
Header
Payload
An API call returning 401, a session dropping for no apparent reason, a doubt about which roles a token actually carries: decoding the JWT is the first debugging reflex. Paste your token and the header and payload appear immediately as formatted, readable JSON — algorithm, issuer, subject, roles, dates. The expiry date is highlighted, with a clear warning when the token has already expired: the single most common cause of unexplained 401s. Important: decoding is strictly local, nothing leaves your browser, and no signature verification is performed — this tool reads the content, it does not prove its authenticity. Free, no sign-up.
How does it work?
- Paste your JWT into the input area.
- Read the header and payload, displayed as formatted JSON.
- Check the expiry date — flagged when it has passed.
- Copy the decoded JSON if you need it.
Frequently asked questions
Does this tool verify the token’s signature?
No, deliberately: it decodes the header and payload (plain Base64URL segments) but performs no cryptographic verification. A token displayed here could be forged or issued by anyone. Signature verification belongs on the server, using the issuer’s secret or public key.
Is it risky to paste a JWT here?
Decoding runs entirely in your browser: the token is neither sent anywhere nor stored. That said, a valid JWT is a key: as a matter of principle, avoid pasting production tokens into any tool, and prefer a test or already-expired token whenever possible.
Why is my token flagged as invalid?
A JWT consists of three Base64URL segments separated by dots: header.payload.signature. The usual causes of failure: a token truncated during copy-paste, a “Bearer ” prefix left attached, line breaks inserted by a terminal, or a token that simply is not a JWT (an opaque session ID, an API key).
What do exp, iat and nbf mean in the payload?
They are Unix timestamps in seconds: “iat” (issued at) dates the issuance, “exp” (expiration) ends the validity window, “nbf” (not before) forbids use before a given time. Servers reject tokens outside that window — which is why clock sync between services matters.