JWT Decoder
Decode a JSON Web Token in your browser — header, payload, claims and expiry, with nothing sent to a server.
Encoded token
This token is still valid.
iat — Tue, 14 Nov 2023 22:13:20 GMT
exp — Sun, 17 Mar 2030 17:46:40 GMT
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Ada Lovelace",
"iat": 1700000000,
"exp": 1900000000
}Signature (not verified)
5m9hZ8kJmTgxV1eE3q6Yr8VJ3Zq0v0eE3q6Yr8VJ3Zq
A JSON Web Token is three Base64URL-encoded parts joined by dots: a header describing the signing algorithm, a payload of claims, and a signature. The first two parts are encoded, not encrypted — anyone holding the token can read them. This decoder splits the token and pretty-prints both, plus converts the iat, exp and nbf timestamps into readable dates and tells you whether the token has expired.
Standard claims worth recognising: iss (issuer), sub (subject — usually the user ID), aud (audience), exp (expiry), iat (issued at), nbf (not before) and jti (unique token ID). Anything else is application-specific: roles, tenant IDs, email, scopes.
This tool does not verify the signature, because verification needs your secret or public key and sending that anywhere would be the actual security risk. Decoding here happens entirely in your browser — the token is never transmitted, logged or stored. Even so, treat production tokens as live credentials and prefer a short-lived test token when debugging.