JWT Decoder
Decode JWT tokens instantly. Header, payload, claims — all client-side.
About the JWT Decoder
This JWT decoder splits a token into its header, payload and signature and shows the decoded claims, converting exp and iat timestamps into readable dates. It runs in your browser, so live tokens are never transmitted.
A JWT decoder answers the question that comes up whenever authentication misbehaves: what does this token actually say? A JWT is three Base64URL segments separated by dots — header, payload and signature — and the payload holds the claims your API is acting on.
The expiry claim is usually the reason you are looking. exp and iat are Unix timestamps, so a raw payload tells you nothing useful; shown as dates it is immediately obvious whether a token has expired, which explains most sudden 401 responses.
Decoding is not verification. Anyone can read a JWT payload, which is why tokens must never carry secrets, and why a decoded token proves nothing about authenticity — only the signature does, and checking it requires the signing key. Because this runs in your browser, pasting a live token does not transmit it anywhere.
How to use the JWT Decoder
- Paste your token. Enter the full JWT including all three dot-separated segments.
- Read the header. Check the signing algorithm and any key ID.
- Read the payload. Inspect the claims, with exp and iat shown as dates.
- Check the expiry. Confirm whether the token is still valid.
JWT Decoder features
- Splits the token into header, payload and signature
- Decodes the claims into readable JSON
- Converts iat, exp and nbf timestamps into dates
- Names the standard claims: sub, iss, aud, jti
- Runs in your browser, so live tokens are never transmitted
Frequently asked questions
Does decoding a JWT verify it?
No, and this is the most important thing to understand about them. The payload is only Base64-encoded, so anyone can read it. Verifying means checking the signature against the secret or public key, which is a server-side job.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and nothing is transmitted, so a live token is not sent anywhere. Treat any token as a live credential regardless — if it appeared in a screenshot or a shared log, rotate it.
What do the standard claims mean?
sub is the subject, usually the user. iss is who issued it, aud who it is for. iat, exp and nbf are issued-at, expiry and not-before times. jti is a unique token id used to revoke individual tokens.
Why is my token rejected when it looks fine here?
Usually expiry or audience. Check exp against the current time and confirm aud matches what the verifying service expects. Clock skew between machines accounts for a surprising number of the remaining cases.
Should sensitive data go in a JWT?
No. The payload is readable by anyone holding the token, so it should carry identifiers and claims, never secrets or personal detail you would not put in a URL.