JWT decoder

Read any JWT without sending it anywhere

Paste a JSON Web Token and the decoder splits it into its three parts: the header (which algorithm signed it), the payload (the claims: who the user is, what they can access and when the token expires) and the signature. The JSON is formatted so you can read it at a glance.

Time claims become real dates. exp, iat and nbf are shown in your own time zone, in UTC and as “in 20 minutes” or “3 days ago”, and the status tells you right away whether the token is still valid, expired or not valid yet.

Tokens often grant access to real accounts, so decoding happens entirely in your browser. The token is never uploaded to our server, logged or stored, which is safer than pasting it into a chatbot or a site that sends it to a server.

How to decode a JWT

1. Copy the token from your app, an Authorization header, a cookie or your browser’s developer tools.
2. Paste it into the box. A Bearer prefix, quotes, spaces and line breaks are removed automatically.
3. Read the summary: status, algorithm, issuer, subject, audience and the exact issue and expiry times.
4. Use the copy buttons to take the formatted header or payload JSON into a bug report or your notes.

What the common claims mean

• exp (expiration time): after this moment the token must be rejected.
• iat (issued at): when the token was created.
• nbf (not before): the token must not be accepted before this moment.
• iss (issuer): who created the token, often the URL of your login server.
• sub (subject): who the token is about, usually a user ID.
• aud (audience): the app or API the token is meant for.
• alg and kid (in the header): the signing algorithm, such as HS256 or RS256, and the ID of the key that signed it.

JWT dates are NumericDate values: the number of seconds since 1 January 1970 UTC. The decoder converts them for you, so you don’t need a separate timestamp converter.

Debugging tips

• If an API answers 401 right after login, check exp and nbf first. A server clock that runs a few minutes fast or slow is a common cause; most libraries allow a small leeway for it.
• A date tens of thousands of years in the future means the value was written in milliseconds instead of seconds. The decoder warns you when that happens.
• Compare aud and iss with what your API expects. A token issued for another app or environment (staging instead of production) is a frequent cause of “invalid token” errors.
• A header with alg set to none means the token is unsigned. Never accept such tokens in production.

Limits and things to know

• Decoding is not verifying. Anyone can create a token with any claims; only checking the signature with the right key, on your server, proves it is genuine. This tool doesn’t verify signatures.
• The payload of a normal JWT is only encoded, not encrypted. Anyone who has the token can read it, so never put passwords or secrets in claims.
• Encrypted tokens (JWE, five parts) can’t be read without the key, so only their header is shown.
• Numbers are shown exactly as they appear in the token, so long numeric IDs are never rounded.

Frequently asked questions

Is it safe to paste a real token here?

Yes. Decoding runs with JavaScript in your browser and the token is never sent to our server. Still, treat live tokens like passwords: don’t share them in screenshots or chats, and let them expire.

Can this tool tell me if a token is valid?

It tells you whether the token has expired or is not valid yet, based on its dates. It can’t tell you whether the signature is genuine, because that needs the secret or public key that only your server should hold.

Why does my token say it expired when I just got it?

Check the clock of the server that issued it and make sure exp is in seconds, not milliseconds. If iat is also hours in the past, the server clock is probably wrong.

What is the difference between a JWT decoder and a Base64 decoder?

A JWT is three Base64URL-encoded parts joined by dots. A Base64 decoder can read one part at a time, but the JWT decoder splits the token for you, handles the URL-safe alphabet and missing padding, and turns the dates into readable times.

Does it work offline?

Yes. Once the page has loaded, you can disconnect from the internet and keep decoding tokens.

Related tools

• Base64 decoder: Decode Base64 strings back to readable text instantly. Inspect auth headers, tokens, API payloads and email content. Free online Base64 decoder.
• JSON validator & beautifier: Validate and pretty-print JSON online. Find syntax errors and turn minified JSON into readable, indented code. Free JSON formatter, no signup.
• URL decoder: Decode percent-encoded URLs and query strings back into readable text. Turn %20, %26 and %C3%A9 into normal characters instantly. Free URL decoder.
• Base64 encoder: Encode any text or string to Base64 instantly. Useful for data URIs, HTTP Basic auth headers, email and APIs. Free online Base64 encoder.