JWT Decoder
A JWT decoder reads a JSON Web Token's Base64URL-encoded header and payload and shows them as readable JSON. This free tool decodes tokens in your browser as you paste them, explains standard claims such as exp, iat and aud, and shows whether the token has expired. It does not verify signatures, so never trust decoded claims on their own.
Free, no signup. Runs entirely in your browser; files and text are not uploaded.
How to use the JWT Decoder
- Paste the token into the Encoded token box; a leading "Bearer " is removed automatically.
- Read the decoded Header and Payload JSON.
- Check the claims table and the expiry status for exp, nbf and iat.
- Copy the header or payload JSON if you need it.
- Verify the signature on your server before trusting any claim.
Features
- Decodes as you paste, with correct Base64URL and UTF-8 handling
- Pretty-printed header and payload JSON with copy buttons
- Readable dates for exp, iat and nbf plus expired / not-yet-valid status
- Claims table for iss, sub, aud, jti and time claims
- Warns about unsigned alg "none" tokens and recognises encrypted JWE tokens
- Specific errors for a wrong part count, invalid Base64URL or invalid JSON
Frequently asked questions
Does this JWT decoder verify the signature?
No. It only decodes the header and payload. Anyone can create a token with any claims, so signatures must be verified on your server with the correct secret or public key before you trust the contents.
Is it safe to paste a production token here?
The token is decoded entirely in your browser and is never sent to a server. Still, treat live tokens like passwords: they grant access until they expire, so prefer test tokens.
Why does my JWT fail to decode?
A signed JWT has exactly three Base64URL parts separated by dots. A missing part, standard Base64 characters or a truncated copy will cause an error, and the tool tells you which part is wrong.
What do exp, iat and nbf mean?
They are Unix timestamps in seconds: exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. The decoder shows each as a date and a relative time.
Related tools
- Base64 Encoder – Encode text or files to Base64 and decode it back, with UTF-8 and URL-safe support
- JSON Formatter – Beautify, minify and validate JSON with error line numbers, key sorting and auto-fix
- Hash Generator – Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files and verify checksums
- UUID Generator – Generate secure random v4, time-ordered v7 or v1 UUIDs in bulk and validate them
Built and reviewed by Naqash Thaheem, Technical Project Manager. Last reviewed 2026-09-24.