Tools
JWT decoder
Paste a JSON Web Token to inspect its header and payload. This decoder splits the token, base64url-decodes each segment, and pretty-prints the JSON, plus it turns standard claims like exp, iat and nbf into readable dates. It runs entirely in your browser: nothing is uploaded, so it is safe for real access tokens.
Paste a token in the form header.payload.signature. It is decoded locally, so nothing leaves your browser.
About JSON Web Tokens
A JWT carries claims about a user or session in a signed, tamper-evident envelope. The three dot-separated segments are the header (algorithm and token type), the payload (claims such as subject, issuer and expiry), and a signature that a server uses to confirm the token has not been altered. Because the header and payload are only base64url-encoded (not encrypted), anyone holding the token can read them, which is exactly what this tool does.
Decoding is not the same as verifying. This tool deliberately stops at decoding: it shows you what a token claims, but it cannot tell you whether those claims are authentic. To trust a token you must verify its signature on the server using the shared secret or the issuer's public key. Treat everything shown here as untrusted input until you have done that.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token made of three base64url-encoded parts separated by dots: a header, a payload of claims, and a signature. It is widely used for authentication and to pass identity between services.
Does this JWT decoder verify the signature?
No. Verifying a signature requires the signing secret (HMAC) or the public key / JWK (RSA, ECDSA), which this tool never has. It only decodes and pretty-prints the header and payload. Never trust an unverified token in production. Always verify server-side.
Is my token sent to a server?
No. All decoding happens locally in your browser using native Web APIs. Your token is never uploaded, logged, or stored. That makes it safe to inspect access tokens and ID tokens without leaking them.
What do exp, iat and nbf mean?
exp is the expiration time, iat is the issued-at time, and nbf is the not-before time. They are Unix timestamps in seconds. This decoder converts them to absolute dates and a relative label such as "expires in 3h" or "EXPIRED 2d ago".
Why does my token fail to decode?
A valid JWT has exactly three dot-separated parts, and the header and payload must be base64url-encoded JSON. Common causes of failure are copying only part of the token, extra whitespace, or a token that is actually encrypted (JWE) rather than signed (JWS).