JWT Decoder
DeveloperDecode a JWT to read its header and payload, and see the expiry and issued-at times in a readable format. Decoding happens locally: your token never leaves the page.
Runs entirely in your browser. Nothing is uploaded.
Decoding only: this tool does not verify the signature. Your token is processed locally and never sent anywhere.
Inspect JSON Web Tokens
When an API rejects a token, the answer is almost always inside the token: the wrong audience, a missing scope, or an expiry that passed an hour ago. A JWT is just Base64url-encoded JSON, so it can be read without any secret — but pasting a live access token into someone else's website hands them a working credential. This decoder parses the header and payload in the page and converts the timestamp claims into readable dates.
How to decode a JWT
- 1
Paste the token
Drop in the full JWT. It is split and decoded locally, with no request made.
- 2
Read the header and payload
See the signing algorithm and token type, plus every claim in the payload, formatted as readable JSON.
- 3
Check the timing claims
`exp`, `iat`, and `nbf` are rendered as human dates so an expired token is obvious immediately.
Good to know
- Decoding is not verification: this reads the claims but does not check the signature, which requires the issuer's secret or public key.
- A JWT payload is only encoded, never encrypted — treat everything in it as readable by anyone holding the token.
- Common claims explained: `exp` expiry, `iat` issued at, `nbf` not before, `iss` issuer, `aud` audience, `sub` subject.
- Because nothing is transmitted, a live production token is safe to inspect here.
What people use it for
- Working out why an API is returning 401 for a token that looks fine
- Confirming which scopes, roles, or claims an access token actually carries
- Checking whether a token has expired and when it was issued
Frequently asked questions
Does this verify the token signature?+
No: it only decodes and displays the header and payload. Signature verification requires the secret/key and should be done server-side.
Is it safe to paste my token here?+
Yes. Decoding happens entirely in your browser; the token is never sent anywhere. Still, treat production tokens with care.
Related tools
JSON Formatter
Beautify, minify & validate JSON
Base64 Encode / Decode
Text ⇄ Base64
URL Encode / Decode
Escape & unescape URL components
Hash Generator
SHA-1, SHA-256, SHA-384 & SHA-512
Or browse all 50 free tools.