JWT Decoder
Paste a JSON Web Token to decode its header and payload as pretty-printed JSON. Issued-at and expiry timestamps are shown in human form. Signatures are NOT verified — this tool is for inspection only.
How to use
- 1
Paste your JWT
Drop a token of the form header.payload.signature into the textarea. Whitespace is trimmed automatically. Use “Load sample” to try one out.
- 2
Read the decoded parts
Header and payload are pretty-printed as JSON. Use the Copy buttons to grab either side. Invalid base64url or non-JSON parts produce a friendly error.
- 3
Inspect the timestamps
If the payload contains iat, exp or nbf claims, you will see their UTC time and a relative note like “in 3 days” or “expired 2 hours ago”.
- 4
Remember the signature is not checked
This tool only decodes. To trust a token, you must verify its signature against the issuer's public key or shared secret separately.
Common use cases
- Inspect the claims of an access token during OAuth/OIDC debugging.
- Check whether a JWT is expired before sending it in an API request.
- See which algorithm a token declares in its header before deciding how to verify.
- Audit the contents of a token issued by your own service.
Limitations
- Signatures are not verified. A tampered token will still decode successfully.
- The tool does not fetch JWKS keys or perform any cryptographic validation.
- Encrypted JWTs (JWE) are not supported — only signed JWS tokens can be decoded here.
- Inputs larger than 1 MB may slow the page; consider trimming before pasting.