JWT Decoder
Paste a JWT to inspect header and payload locally. Check expiry and common claims. Decoding does not prove the signature is valid.
Paste a JWT to inspect header and payload locally.
How to decode a JWT
- Paste a token in header.payload.signature form.
- Decode runs as you type, or press Ctrl+Enter (Cmd+Enter on Mac).
- Inspect header JSON, payload JSON, and exp/nbf/iat when present.
- Copy payload JSON if needed. This page does not verify signatures.
FAQ
- No. This tool only Base64URL-decodes the header and payload. A readable token is not a trusted token. Signature verification is a separate step and is not included here.
- When present as numeric Unix timestamps, the tool shows absolute UTC time and a relative phrase such as “expires in 12m” or “expired 3h ago”. Color alone is not the only signal.
- No. Decoding runs entirely in your browser. Tokens are not sent to a server, logged, or persisted.
- A JWT must be header.payload.signature with dots separating exactly three Base64URL segments. Missing dots, extra segments, or pasted Bearer prefixes can trigger this error.
- Yes. Expiry only affects whether the token should be trusted at runtime — decoding still shows header and payload so you can inspect claims and exp timestamps.