JWT Decoder
Decode a JSON Web Token to inspect its header, payload, and signature instantly.
How to Use
- Paste a JWT (the long dot-separated string) into the input.
- The header and payload decode instantly into readable JSON.
- Check the "exp" claim to see expiry time, shown in local time.
- The signature segment is shown but not verified — verification requires your secret/private key.
When to Use This
- Finding out why an API keeps answering 401, by checking whether the token being sent had already expired when the request went out.
- Confirming which tenant, scope or role claim an identity provider actually issued, rather than what the integration documentation promised it would.
- Reading the alg and kid values from the header when you need to know which key a verifier is expected to look up.
- Comparing the iat claim against your own clock when a gateway starts rejecting freshly minted tokens as not yet valid.
Frequently Asked Questions
About This Tool
A JWT is three base64url segments joined by dots. Base64url is not encryption: it swaps plus and slash for hyphen and underscore and drops the padding so the result survives a URL, and anyone holding the token can read the claims. The signature at the end is computed over the first two segments, which is why altering a single character of the payload invalidates it. Registered claims such as iss, sub, exp, iat and nbf come from RFC 7519; everything else is whatever the issuer chose to add.
Decoding happens in the page. The token is split on dots, each of the first two segments is padded back to a multiple of four, passed through atob, percent-decoded so non-ASCII claims survive, then parsed as JSON. The exp and iat values are read as Unix seconds and rendered in your machine's local time, and the header's algorithm is shown alongside.
Notes & Limits
- Expiry is judged against your computer's clock, so if that clock is wrong a live token can look expired and an expired one current.
- An encrypted JWT in JWE form has five segments and is rejected here, because its payload is ciphertext rather than base64url-encoded JSON.
- The nbf, aud and iss claims are displayed but never evaluated, so nothing here tells you the token is acceptable to a given audience.
- An exp expressed in milliseconds, which some systems emit by mistake, is multiplied by a thousand anyway and renders as a date far in the future.