JWT Decoder

What is JWT Decoder?

JWT (JSON Web Token) is the most common stateless authentication token, made of three Base64Url-encoded parts: Header, Payload and Signature. When you wonder "why did my session expire" or "what claims does this token carry", this tool splits the three sections in one click: standard claims such as iss/sub/aud/exp/iat in the Payload come with annotations, and exp/nbf/iat timestamps are converted to your local time. Decoding happens entirely in your browser — the token never touches the network.

How to Use

1. Paste a complete JWT (a Bearer prefix is fine)
2. Inspect the decoded Header and Payload with claim explanations
3. Check time claims such as exp and iat

FAQ

Does this tool verify the signature?

No. Decoding only performs Base64Url parsing — signature verification requires the secret key and must be done on your server.

Is it safe to paste a JWT into an online tool?

Decoding here runs entirely in your browser with zero network transfer. Still, production tokens are sensitive credentials — only use them in environments you trust.

Why does my token decode into garbage?

Make sure it is a standard JWT (three Base64Url segments separated by dots). Encrypted JWE tokens cannot be decoded directly.

What unit are exp and iat in?

Unix timestamps in seconds (NumericDate); the tool converts them to readable times automatically.

Related Tools