JWT Decoder
Decode JWT header & payload, with human-readable claim times and an expiry status. Live. (Signature is not verified.)
About this ToolHow it works, benefits & use casesTap to collapse
Paste a JSON Web Token and this decoder splits it into its three dot-separated parts and shows you what is inside. It Base64url-decodes the header and payload and pretty-prints each as formatted JSON, surfaces the algorithm (alg) and type (typ) from the header, and renders the time-based claims — issued-at (iat), not-before (nbf), and expiry (exp) — as both an ISO timestamp and a human-readable relative time like "in 3 days" or "2 hours ago". A status badge tells you at a glance whether the token is valid, expired, not yet valid, or has no expiry claim. The signature is displayed but, importantly, never verified — decoding reveals the contents but does not prove authenticity, and the tool says so clearly. Header and payload each have their own copy/download panel. Everything happens live in your browser; your token is never transmitted.
How to Use
- 1Paste your JWT (header.payload.signature) into the token box, or click "Load example" to try a sample.
- 2The decoder runs instantly — read the Claims card for the algorithm, type, and a valid/expired status badge.
- 3Review the issued-at, not-before, and expiry rows, each shown as an ISO time plus a relative description.
- 4Inspect the formatted Header and Payload JSON in their separate panels and copy or download either one.
- 5Note the Signature is shown but not verified — use it for inspection only, not to confirm authenticity.
Key Benefits
- Splits and Base64url-decodes the header and payload into pretty-printed JSON
- Reads the alg and typ straight from the header
- Shows iat, nbf, and exp as ISO timestamps plus human relative times
- Status badge flags valid, expired, not-yet-valid, or no-expiry tokens at a glance
- Separate copy/download panels for header and payload
- Clear warning that the signature is displayed but not verified
- Runs entirely in-browser — tokens are never sent anywhere
Common Use Cases
- Checking whether an access token has expired while debugging auth
- Inspecting the claims a backend issued without writing decode code
- Confirming which signing algorithm (HS256, RS256, …) a token declares
- Reading custom payload fields like sub, scope, or role during development
- Teaching how a JWT is structured into header, payload, and signature
0 characters · live
Paste a JWT above to decode it.
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related guides
- Guide · 13 min readJWT Decoding and Verification: What Is Actually Safe to TrustDecoding a JWT and verifying one are not the same operation, and only one proves anything. A practical guide to the three Base64url parts, the alg attacks that breached real systems, correct verification with jose, claim validation, and safe client storage.Read the guide
- Guide · 9 min readBearer Tokens Explained: The Authorization Header, API Keys, and What "Bearer" Actually MeansWhat a bearer token is, the exact Authorization header syntax, how to send one from curl, fetch, axios, and Postman, how bearer tokens differ from API keys and JWTs, and how to generate signed test tokens in your browser.Read the guide
Related tools
- Bearer Token GeneratorGenerate Bearer authentication tokens
- JSON FormatterFormat and validate JSON with syntax highlighting
- Binary to TextConvert binary to readable text
- Design Token GeneratorPerceptual colour ramps + light/dark semantic tokens, live preview, WCAG audit — export CSS, Tailwind v4, W3C DTCG & more
- AI Token Counter & Cost EstimatorCount tokens and estimate API cost across GPT, Claude, Gemini & more — with a live multi-model comparison and context-window fit
- Base64 Encoder/DecoderEncode and decode Base64 strings
No. It decodes and displays the header, payload, and signature, but it does not cryptographically verify the signature against a key. Decoding only reveals what the token claims — it does not prove the token is authentic or untampered. Always verify the signature server-side with the issuer’s key before trusting a token.
It compares the payload’s exp (expiry) and nbf (not-before) claims against the current time. If exp is in the past the badge reads Expired; if nbf is in the future it reads Not yet valid; if there is no exp claim it reads No expiry claim; otherwise it reads Valid. Each time claim is also shown as an exact ISO timestamp with a relative description.