JWT Decoder
Paste a JWT and instantly see its decoded header and payload as formatted JSON. Standard time claims (exp, iat, nbf) are shown alongside their human-readable date.
How to use
A JWT has three dot-separated, Base64URL-encoded parts: header.payload.signature. This tool decodes the first two — they're just Base64, not encrypted, so anyone holding the token can already read them without a secret key.
The third part, the signature, is not decoded because it's a cryptographic hash, not encoded data — and it can't be verified here since that requires the issuer's secret or public key. This tool is for inspecting claims during debugging, not for validating whether a token is authentic.
FAQ
Is a JWT payload encrypted?
No. A standard JWT (JWS) is signed, not encrypted — the header and payload are just Base64URL-encoded JSON, readable by anyone. Never put secrets in a JWT payload; use encrypted JWTs (JWE) if confidentiality matters.
Can this tool verify if a token is valid?
No — verifying a signature requires the issuer's secret (HMAC) or public key (RSA/ECDSA), which this tool never asks for or has access to. It only decodes and displays the contents.
What do exp, iat and nbf mean?
Standard time claims in Unix seconds: `iat` is when the token was issued, `exp` is when it expires, `nbf` is "not before" — the token is invalid until that time. The decoder shows the equivalent ISO date next to each.
Is it safe to paste a production token here?
Decoding happens entirely in your browser; the token is never sent anywhere. That said, treat access tokens as secrets in general — avoid pasting live tokens into any tool, including this one, when you can use a redacted or expired example instead.