JWT Decoder
Decode a JSON Web Token (JWT) to inspect its header and payload — entirely in your browser, nothing is sent anywhere.
Suggested tools
About JWT Decoder
JWT Decoder decodes a JSON Web Token and shows its header, payload and signature separately. Each standard claim is explained (iss, sub, aud, exp, nbf, iat…), times are shown as readable dates, and the status tells you at a glance whether the token is valid, expired or not yet valid.
Decoding only reads the token; it does not verify the signature, which requires the secret or public key. It runs entirely in your browser, so nothing you paste is uploaded. That matters, because tokens grant access to accounts.
How to use JWT Decoder
- Paste the token (the three parts separated by dots).
- Read the decoded header, payload and claim explanations.
- Check the status and expiry time.
Key features
- Header, payload and signature shown separately
- Explanations for standard claims
- exp / nbf / iat shown as dates with status
- Never sent to any server
Example
The header and payload are only Base64URL-encoded, so anyone can read them; the signature is not checked.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMDI0IiwibmFtZSI6IkFzaGEgUGF0ZWwiLCJyb2xlIjoiZWRpdG9yIiwiaWF0IjoxNzY3MjI1NjAwfQ.c2lnbmF0dXJl
Header:
{
"alg": "HS256",
"typ": "JWT"
}
Payload:
{
"sub": "1024",
"name": "Asha Patel",
"role": "editor",
"iat": 1767225600
}
Issued at (iat): 2026-01-01T00:00:00.000ZWhen to use JWT Decoder
- Checking why an API returns 401 — expired token, wrong audience or missing role.
- Seeing which claims an identity provider puts in its tokens.
- Confirming the expiry time of a token during testing.
Tips and common problems
- Paste the token without the "Bearer " prefix.
- exp, iat and nbf are in seconds, not milliseconds.
- Never paste production tokens into tools that send data to a server; this one decodes locally.
Frequently asked questions
No. Verifying needs the signing secret or public key. Never trust a token's contents in your application without verifying it on the server.
Yes — the header and payload are only Base64URL-encoded, not encrypted. Do not put secrets in a JWT payload.
The exp time is in the past. Times are compared with your device's clock, so check that it is correct.
Guides
- JWT Explained: What Is Inside a JSON Web Token — JSON Web Tokens explained: header, payload and signature, claims like exp and iat, why anyone can read a JWT, and mistakes that cause security problems.
- Unix Timestamps Explained — What a Unix timestamp is, how to tell seconds from milliseconds, why timestamps have no time zone, how to convert them to IST, and the year-2038 problem.