JWT Decoder
JWT Decoder inspect JWT header payload decode token claims locally read JWT expiration timestampInspect token contents without trusting them
Paste a three-part compact JWT and choose Decode token. The page displays formatted header and payload JSON plus readable dates for numeric iat, nbf, and exp claims.
Three compact parts
A typical signed JWT contains a Base64url-encoded header, a Base64url-encoded payload, and a signature separated by periods. Decoding the first two parts reveals JSON claims. It does not require a secret because those sections are encoding, not encryption. Anyone holding the token can normally read them.
Worked example
A payload containing {"sub":"123","exp":1893456000} identifies a subject and provides an expiration instant in Unix seconds. The decoder formats that number as an ISO date. It does not decide whether the subject exists, whether the issuer is authorized, whether the clock is acceptable, or whether the signature matches.
Decoding is not verification
Never authorize a request based only on decoded text. Real verification must enforce the expected algorithm, key, issuer, audience, signature, and applicable time claims using a maintained JWT library in the trusted application environment. Accepting an algorithm named by an untrusted header without policy checks has caused serious security flaws.
Claims require application context
Registered names such as iss, sub, aud, exp, nbf, and iat have defined roles, while private claims depend on the issuing system. A readable expiration date does not prove that the token is current because clock skew, revocation, sessions, key rotation, and server policy can all affect acceptance.
Privacy and limitations
Decoding runs in this browser and no token is uploaded by the tool. Tokens may contain credentials or personal data, so avoid pasting production secrets into devices, browsers, extensions, or screen-sharing sessions you do not trust. This page does not verify signatures, decrypt JWE tokens, fetch public keys, validate schemas, or store token history.
JWT Decoder FAQ
Does a readable payload mean the token is valid?
No. Readability says nothing about signature authenticity or application policy.
Why are there no readable claim dates?
The payload may omit numeric iat, nbf, and exp values.
Can this decode encrypted JWT content?
No. It handles compact tokens whose first two parts contain JSON.