JWT Decoder

Decode a JWT's header and payload with readable timestamps for exp/nbf/iat — decoding only, never signature verification.

This tool only decodes a JWT's header and payload — it does not and cannot verify the signature. A token decoding successfully proves nothing about whether it is authentic or was issued by who it claims to be; only the party holding the signing key can verify that.

Decoding happens entirely in your browser. The token you paste is never sent to a server and is never logged anywhere by this tool.

A JWT (JSON Web Token) has three dot-separated parts — a header, a payload, and a signature. The header and payload are just Base64URL-encoded JSON, so anyone can decode and read them without any key; only the signature can prove the token is genuine, and checking it requires the issuer's secret or public key, which this tool never has.

Standard claims: exp (expiration), nbf (not valid before), and iat (issued at) are Unix timestamps (seconds since 1970) — shown here as readable dates. iss, sub, and aud identify the issuer, subject, and intended audience.

A common mistake is treating a successfully-decoded token as proof it's legitimate. Anyone can construct a syntactically valid JWT with any claims they like — decoding it will always "work." Whether to trust it depends entirely on verifying its signature server-side, which is a separate step this tool deliberately does not perform.

How to use the JWT Decoder

Paste the full token (header.payload.signature) into the text box; it decodes as you paste.
Read the Header and Payload panels, both shown as indented JSON.
Check Standard claims for iss, sub, aud, jti and the iat, nbf and exp dates with their expired or not-yet-valid status.
Use Copy beside either panel to copy that JSON, or Clear to remove the token.

Example: Decoding a sample HS256 token

Paste eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c. The header decodes to {"alg": "HS256", "typ": "JWT"} and the payload to {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}. Standard claims lists sub 1234567890 and iat (issued at) 2018-01-18T01:30:22.000Z.

Questions about the JWT Decoder

What time zone are the iat, nbf and exp dates in?: They are shown in UTC as ISO 8601 strings ending in Z. The expired and not-yet-valid labels compare the claim against your device's current clock, so a wrong system clock gives a wrong label.
Why do I get "it isn't valid Base64URL" when pasting from an Authorization header?: Remove the "Bearer " prefix and any quotes first. The tool expects only the token itself, and extra text in the first segment makes the header impossible to decode.
What do the different error messages mean?: "Exactly three dot-separated parts" means the token is truncated or has extra dots. "Isn't valid Base64URL" means a segment contains characters that cannot be decoded, and "decoded, but isn't valid JSON" means the segment decoded to text that is not JSON.
Does it decode tokens with an empty signature?: Yes. A token ending in a dot with no signature still decodes as long as it has three parts, since the tool never checks the signature.