JWT Decoder
Decode JWT headers and payloads, with expiration and timestamp claims explained.
Runs in your browser — your data never leaves your deviceFree, no sign-up
How it works
The token is split into its three dot-separated segments. The header and payload are base64url-decoded and parsed as JSON — exactly what every JWT library does to read a token. The signature segment is not a JSON document, so it is displayed as-is.
Registered timestamp claims (iat, nbf, exp) are translated into readable dates with a relative description, and well-known claims (sub, scope, iss, …) are explained inline.
Features
- Decodes header and payload into pretty-printed JSON
- Expiry check based on the exp claim
- Human-readable timestamps for iat / nbf / exp
- Explanations for registered and common claims
- Clear errors for malformed or truncated tokens
- 100% client-side — the token never leaves your browser
How to use
- Paste the JWT (the eyJ… string, without “Bearer ”).
- Press Decode.
- Read the header, payload, timestamps and claim explanations; copy any part you need.
Security notes
- A JWT payload is encoded, not encrypted — never put secrets in one.
- An unverified signature means the claims are attacker-controlled input until proven otherwise.
- Treat “not expired” as a clock check only — servers can revoke tokens at any time.
Frequently asked questions
- Does this tool verify the JWT signature?
- No — and no honest decoder can without the issuer's secret or public key. This tool decodes and explains the header and payload only. The signature is shown as-is and clearly marked as not verified. Never trust claims from a token whose signature you have not verified.
- What are the three parts of a JWT?
- A JWT is three base64url-encoded segments joined by dots: the header (metadata like the signing algorithm), the payload (the claims — the actual data), and the signature (used to prove the token was not tampered with).
- Is decoding a JWT safe?
- Decoding only reads information that is already in the token — a JWT's payload is not encrypted, just encoded. Anyone holding the token can read it; that is by design. Decoding happens entirely in your browser here, so the token is not disclosed to anyone new.
- Why is my token shown as expired?
- The exp claim (a unix timestamp) is compared against your device's clock. If exp is in the past, the token is expired. Note that a large clock skew on your device can produce a wrong verdict, and a token that is not expired may still have been revoked server-side.
- Can I decode a JWT that starts with 'Bearer '?
- The tool detects that prefix and asks you to remove it — the raw token starts with eyJ…, because the header of virtually every JWT begins with the same bytes when encoded.