Developer Tools
JWT Decoder
Inspect JWT header and claims, including expiry and audience.
JSON Web Token
A token pasted with the Bearer prefix is accepted.
About JWT Decoder
A JSON Web Token is three Base64URL segments joined by dots: a header describing how it was signed, a payload of claims, and a signature. Because the first two segments are only encoded, not encrypted, you can read them directly, which is invaluable when a token is rejected for reasons that turn out to be an expiry or audience mismatch.
This decoder splits the token, decodes both segments, and highlights the standard time-based claims with their human-readable values and current validity. Note that decoding is inspection only: verifying a signature requires the key and is never something a browser tool should pretend to do.
How it works
- The token is split into header, payload and signature segments.
- The first two segments are Base64URL-decoded and parsed as JSON.
- Registered claims such as exp, iat and nbf are converted into readable timestamps.
- Each time-based claim is compared with the current clock to show valid or expired.
- The algorithm, key identifier and token type from the header are summarised.
Input and output
Accepts
A JWT string, including one still prefixed with Bearer.
Produces
Decoded header and payload JSON, a claim summary, and expiry status.
Privacy
Decoding happens in your browser. Tokens are credentials, so nothing is logged, stored or transmitted.
JWT Decoder FAQ
Does this tool verify the signature?
No. Signature verification needs the signing key or public key and must be done by your service. A browser decoder only reads the encoded header and payload.
Why is it safe to decode a JWT but not share it?
The payload is readable by anyone, which is why it should not contain secrets. The token is still a bearer credential, so treating the whole string as sensitive is correct.
What do the exp, iat and nbf claims mean?
exp is the expiry time, iat is when the token was issued, and nbf is the earliest time it may be used. All three are Unix timestamps in seconds.
Why does my token show as expired immediately?
Either the server clock and your clock disagree, or exp was written in milliseconds instead of seconds. Compare the decoded value against the current epoch time.
Related developer tools
Base64 Encoder / Decoder
Encode and decode Base64 with correct UTF-8 and URL-safe variants.
Timestamp Converter
Convert between epoch time and readable dates in both directions.
Hash Generator
Generate SHA digests and CRC32 checksums and compare them.