About this jwt decoder
A compact signed JWT is three Base64URL sections: a JOSE header, a claims payload and a signature. Decoding the first two sections only reveals their text; it does not establish who created the token or whether it was changed.
The inspector converts numeric exp, nbf and iat claims to UTC using the current device clock. These readings are advisory because real validation also needs issuer, audience, algorithm, key and application policy checks.
JWT (JSON Web Token) headers and payloads are Base64URL-encoded but not encrypted, so decoding reveals the claims immediately. When debugging authentication issues, investigating token structure, or reviewing claims before integration, a fast JWT decoder saves time. This free online tool decodes compact three-part JWTs instantly, showing you exactly what the token contains—all locally in your browser, with no server uploads or third-party dependencies.
JWT payloads carry critical information: subject (sub), expiration (exp), issued-at (iat), not-before (nbf), and custom claims. This decoder highlights time-based claims and converts them to readable dates, helping you understand token validity windows and identify expiration issues quickly. It also handles JOSE headers, showing algorithm and key ID information needed for validation decisions. The permanent warning reminds you that decoded content is not verified—always validate in production authentication code.
Perfect for debugging authentication flows, understanding token structure before building integrations, and investigating claims when tokens fail validation. Works with three-part signed JWTs (not five-part encrypted JWE tokens). Supports sharing decoded token links for team review. Keep tokens private—although the decoder is client-side, avoid pasting production credentials on untrusted devices or networks.
How to use this tool
-
01
Paste a compact signed JWT
Use the three-part representation. Five-part JWE values are encrypted and this decoder reports them as unsupported instead of exposing plaintext.
-
02
Read header and claims
Inspect the decoded JSON and signature byte count. The page never fetches jku, x5u or any other remote key URL.
-
03
Validate somewhere appropriate
If the token controls access, verify it in a reviewed authentication library with a trusted key and fixed validation policy.
Worked examples
Registered time claim
Payload: {"sub":"123","exp":1700000000}exp is displayed as 2023-11-14T22:13:20.000Z; this does not verify the token.Encrypted JWE
Five dot-separated sectionsReported as an encrypted JWE that this local decoder does not decrypt.Limits and edge cases
- Syntax, a future expiry time and a present signature are not proof that a JWT is valid. This page performs no cryptographic verification.
- JWT NumericDate values count seconds since the Unix epoch and may contain fractions. Time status depends on the current device clock.
- Five-part JWE tokens are encrypted. Nested tokens and detached or unencoded JWS payload extensions are outside this tool’s scope.
- Tokens often contain personal or authorization data. Although this page processes locally, avoid pasting production credentials into any device or page you do not trust.
Standards and references
Common questions
Can this page tell whether a JWT is valid?
No. It decodes text only. Validation needs a trusted key, an allowed algorithm, signature verification and checks for issuer, audience and required claims.
Why can I read a JWT without its secret?
Signed JWT headers and payloads are encoded, not encrypted. The signature protects integrity when verified, but it does not hide those sections.