JWT Decoder

What this tool does

JWT Decoder decodes a JSON Web Token’s base64url-encoded header and payload entirely in your browser, pretty-printing the claims and converting standard timestamp claims (exp, iat, nbf) into human-readable dates, including an expiry status check. This does not verify the signature.

A JWT (JSON Web Token) is just base64url-encoded JSON wrapped around a signature, meaning anyone can read its header and payload without any special tool or secret key, but doing that by hand, decoding each part and converting Unix timestamps mentally, is tedious for routine debugging.

This decoder splits a pasted token into its header and payload, decodes and pretty-prints both as JSON, and converts standard timestamp claims (exp, iat, nbf) into readable local dates with an explicit expired/not-expired status, all locally in your browser with no server round-trip.

How to use JWT Decoder

1. Paste the full JWT (header.payload.signature).
2. Review the decoded Header and Payload.
3. Check the human-readable timestamps and expiry Status, if present.
4. Copy the raw Signature if needed for separate verification elsewhere.

Tips for better results

• This tool deliberately does not verify the signature, decoding and verification are different operations; decoding only reveals what the token claims, not whether those claims are genuinely trustworthy.
• The exp (expires at), iat (issued at) and nbf (not valid before) claims are standard Unix timestamps in seconds; this tool automatically converts any of them present into your local date and time.
• Since a JWT’s payload is just base64url-encoded, not encrypted, never put secret or sensitive data directly in a JWT payload, anyone who gets hold of the token can read it, exactly like this tool does.
• A malformed or truncated paste will show a parsing error rather than partial, misleading output, which is deliberate so you don’t mistake incomplete data for a complete, valid token.

Common use cases

• Debugging why an API request with a JWT is failing by inspecting its actual claims.
• Checking when a token expires without writing a script to decode it.
• Inspecting a token’s claims during development without needing the signing secret.
• Learning JWT structure by seeing the header/payload/signature split clearly.

Common mistakes to avoid

• Treating a successfully decoded token as verified or trustworthy; decoding only shows what a token claims, it says nothing about whether the signature is genuine, which requires the actual signing secret or public key.
• Putting sensitive data (passwords, secrets, personal information) directly in a JWT payload, assuming it’s hidden; it’s only base64-encoded, not encrypted, and trivially readable by anyone, as this tool demonstrates.
• Confusing an expired token error with a signature verification failure; this tool checks expiry purely from the exp claim’s value against the current time, a separate concern from signature validity.