JWT Decoder
Paste a JWT to read its header and payload, with the issued, not-before and expiry times shown as readable dates. Useful for debugging auth problems.
🔒 The token is decoded entirely in your browser and never sent anywhere. Still, treat any token you paste as a live credential.
How to use it
Paste a token. The header and payload are decoded and pretty-printed, and the time claims are shown as dates so you can see at a glance whether the token has expired.
What the parts are
A JWT has three parts separated by dots: a header (the signing algorithm), a payload (the claims, such as who the user is and when the token expires), and a signature. The first two are just Base64url-encoded JSON, which is why they can be read without any key.
Important: this does not verify the token
Decoding and verifying are different things. This tool reads the token but does not check the signature, so it cannot tell you whether the token is genuine or has been tampered with. Verification needs the issuer’s secret or public key and should happen on your server. Never trust a JWT’s contents based on decoding alone.
FAQ
Is it safe to paste a token here? The decoding happens in your browser and nothing is sent anywhere. That said, a JWT is often a live credential, so avoid pasting production tokens into any tool you do not control, including this one.
Why does my token show as expired?
Compare the exp date with now. Clock skew between servers is a common cause of tokens that look valid but are rejected.