JWT Decoder
Paste a JSON Web Token and instantly decode its header and payload — entirely in your browser, nothing is uploaded
JSON Web Token
About this tool
The JWT decoder reads a JSON Web Token and shows what is inside it. A JWT has three dot-separated parts — a header, a payload and a signature — and the first two are just Base64URL-encoded JSON. This tool decodes them into readable, formatted JSON so you can inspect the algorithm, token type and every claim. Standard time claims such as exp (expiration), iat (issued at) and nbf (not before) are converted from raw UNIX seconds into human-readable dates, and an expired token is flagged for you. Crucially, the tool never verifies the signature and never asks for a secret or public key: decoding only needs the token itself. Because of that, everything happens locally in your browser and nothing is ever uploaded — making it safe to inspect tokens without leaking them to a server.
How to use
- 1 Paste your JSON Web Token (header.payload.signature) into the input box, or click Load sample to try one.
- 2 The header and payload are decoded instantly and shown as formatted JSON.
- 3 Check the alg and typ badges, and read exp / iat / nbf as human dates; an expired token is highlighted in red.
- 4 Use the copy buttons to grab the decoded header or payload. Nothing you paste ever leaves your browser.
How it works
A JWT is written as three Base64URL strings joined by dots: header.payload.signature. Base64URL is like standard Base64 but uses - and _ instead of + and /, and usually drops the trailing = padding. The decoder restores those characters, adds back any missing padding, runs atob to get the raw bytes, and reinterprets them as UTF-8 so non-ASCII claims display correctly. The header and payload are then parsed as JSON and pretty-printed. Numeric exp, iat and nbf claims are UNIX timestamps in seconds, so they are multiplied by 1000 and turned into dates; if exp is in the past the token is marked expired. The signature segment is shown untouched and is never validated, which is why no key is needed and the whole process stays on your device.
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes the header and payload so you can read them. Verifying the signature would require the signing secret or public key, which this tool intentionally never asks for. That keeps everything local and means you can safely inspect a token's contents without exposing any key.
Is my token sent to a server?
No. All decoding happens in your browser with JavaScript. Your token is never uploaded, logged or stored, and the tool keeps working offline once the page has loaded. It is safe to paste sensitive tokens here.
What do the exp, iat and nbf fields mean?
They are standard time claims expressed as UNIX timestamps in seconds. exp is when the token expires, iat is when it was issued, and nbf is the earliest time it is valid. This tool converts each one into a readable date and flags the token as expired when exp is in the past.
Can I read a JWT without the secret key?
Yes. The header and payload of a JWT are only Base64URL-encoded, not encrypted, so anyone can read them without any key. The secret or public key is only needed to verify the signature, which proves the token has not been tampered with — but it is never needed just to see the contents.
Why does my token show garbled text or an error?
A JWT must have exactly three parts separated by dots, each a valid Base64URL string, and the first two must decode to valid JSON. If a part is missing, truncated, or you accidentally pasted an encrypted JWE instead of a signed JWS, the decoder reports an error rather than guessing.
Related tools and uses
Pair the JWT decoder with the Base64 tool to inspect individual segments by hand, the JSON formatter to reformat a copied payload, and the Unix timestamp converter to double-check exp/iat/nbf times. Developers reach for it when debugging authentication flows, OAuth/OpenID Connect tokens, API gateways and single sign-on, where reading a token's claims quickly is part of everyday work.