About JWT Decoder
A JSON Web Token is three base64url segments joined by dots: a header naming the algorithm, a payload of claims and a signature. The header and payload are only encoded, not encrypted, so anyone holding the token can read them. The signature is what proves the token came from someone with the signing key, and only a real verification step can show that.
This decoder splits the token, converts both JSON segments with correct UTF-8 handling and pretty-prints them. It also turns exp, iat and nbf into local dates and compares them with your clock, so an expired or not-yet-valid token is obvious at a glance. It never asks for a secret and never claims the signature is valid.
What this tool does
Header and payload as JSON
Both base64url segments are decoded with UTF-8 handling and printed with two-space indentation, and each panel has its own copy button.
Expiry at a glance
The exp, nbf and iat claims are shown as readable local dates plus UTC ISO strings, with expired, valid and not-yet-valid state labels.
Signature shown, not checked
The raw signature segment and its byte length are displayed for inspection, next to a clear notice that no verification happened and no key was used.
Bearer prefix and wrapping tolerated
Tokens copied from an Authorization header or wrapped across lines by a terminal are cleaned up before decoding, along with missing base64url padding.
Malformed tokens explained inline
Wrong segment counts, unusable base64url, invalid UTF-8 and non-JSON segments each get a specific sentence instead of a generic failure.
Nothing leaves the tab
Decoding is plain JavaScript with no network request, no storage and no third-party library, so the token stays in page memory.
How to use JWT Decoder
- 01
Paste the token
Copy the JWT with all three segments and paste it into the field; a Bearer prefix and line breaks are fine.
- 02
Check the header
The header JSON shows the algorithm and token type; confirm alg matches the algorithm your server expects before trusting anything else.
- 03
Read the claims
The payload JSON lists every claim, and the time section turns exp, iat and nbf into local dates with a state label.
- 04
Copy what you need
Use the copy button on the header, payload or signature panel to move that JSON or segment into a ticket or an editor.
- 05
Verify it properly
Take the token to your server-side code or a JWT library and verify the signature with the signing key before trusting any claim.
How this tool works
- Works with
- JWT → JSON
- Processing
- Client-side, in your browser. Nothing is uploaded.
- Requirements
- Chrome, Edge, Firefox or Safari · JavaScript enabled
Limitations worth knowing
- Decoding only: signatures, issuer, audience and the algorithm allow-list are not verified.
- Encrypted JWE tokens are not supported; they need the decryption key and five-segment handling.
- Expiry states use your device clock and ignore server leeway, so a token near its exp boundary can disagree with the API.
- A JWT payload is readable by design, so this tool cannot protect a token that you should not have.
Privacy and file handling
The token is decoded with JavaScript inside this browser tab. It is not uploaded, stored or logged, and decoding makes no network request. Treat any JWT as a secret anyway, because a valid token can act as a login credential until it expires.
Read the full privacy policy