JWT Decoder
Paste a JWT (JSON Web Token) to decode its header and payload into clean, readable JSON. Timestamp claims like exp (expiration) and iat (issued at) are converted to human-readable dates, and expired tokens are flagged. Everything runs in your browser — your token is never sent to any server.
Paste a JWT and the decoded result will appear here.
| Claim | Value (Unix sec) | Date (local) |
|---|
Standard claims found in the payload (registered claims and common OIDC claims) are detected and shown with their meaning and value.
| Claim | Value | Meaning |
|---|
How to Use
Paste your JWT
Paste a JWT string into the input box. Standard three-part tokens ("header.payload.signature") are supported.
Review the decoded result
The header and payload appear as formatted JSON automatically, and exp/iat/nbf are converted to dates. Expired tokens are flagged with a warning.
Copy what you need
Use the "Copy" button on each block to copy the formatted JSON to your clipboard in one click.
What is a JWT (JSON Web Token)?
A JWT consists of three parts — header, payload and signature — joined by dots (.). The header and payload are Base64URL-encoded JSON (not encrypted) and are widely used as authentication and API access tokens. This tool only decodes the Base64URL to reveal the contents; it does not verify the signature. Signature validation must be done server-side with your secret.
Features
- Real-time DecodingHeader and payload appear as formatted JSON the moment you paste. No waiting.
- Automatic Expiry Checkexp/iat/nbf are converted to readable dates, with color-coded warnings for expired or not-yet-valid tokens.
- Fully PrivateEverything runs in your browser. The token is never uploaded and the signature is never verified.
- Copy-ready & FreeCopy formatted JSON with one click. No registration or install, free to use as often as you like.
Use Cases
- Quickly inspect the contents of API bearer tokens
- Debug login issues (check expiry and claims)
- Debug OAuth / OpenID Connect id_token & access_token
- Verify claims passed from frontend to backend
- Learn JWT structure or explain it to your team
Related Tools & Reading
To see how Base64URL works hands-on, try our Base64 encoder / decoder. The hashes used in signatures can be produced with the hash generator, and unique identifiers like the jti (JWT ID) claim can be created with the UUID generator. To understand how JWTs work and where to use them, read our guide: What is a JWT? A plain-English explanation.
FAQ
Is the JWT decoder free to use?
Is my pasted token sent to a server?
Can it verify the signature?
Is a JWT encrypted? Is it safe if someone sees the contents?
It says "This token has expired" — what does that mean?
What token formats are supported?
Feedback
Missing a feature, or getting a result that looks wrong? Let us know — we improve our tools based on your feedback.