JWT decoder
Inspect JWT header and payload JSON, timestamps, and signature size with a clear unverified-token status.
How it works & useful details
How to use this tool
Paste a three-part JWT to inspect its header, payload, and UTC dates. Use the example to explore the panels.
Details and limits
This decoder does not verify signatures, authenticate users, validate issuers or audiences, or decide whether a token is valid. Claims and declared algorithms can be forged. Do not use this result to make authorization decisions.
Up to 32,000 characters. Header and payload must be JSON objects encoded as UTF-8 Base64url. JWE encrypted five-part tokens are not supported. The token remains only in page memory.
About this tool
JWT decoder inspects a JSON Web Token’s header and payload, formats the claims, highlights time-based claims, and reports the signature size. It is a quick way to answer "what is in this token" during debugging.
The token is decoded, not verified: the tool clearly marks the result as unverified because verification requires the issuer’s key and algorithm checks. Decoding is local, and the token is never sent anywhere.
How to use it
- Paste the JSON Web Token.
- Review the decoded header and payload JSON.
- Check the formatting of time claims such as exp and iat.
- Note the unverified status before trusting any claim.
Worked example
A JWT has three Base64url parts separated by dots: header.payload.signature. Decoding
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSIsImlhdCI6MTc5MDAwMTc3NCwiZXhwIjoxNzkwMDA1Mzc0fQ.c2lnshows the header {"alg":"HS256","typ":"JWT"} and the payload with sub, name, iat, and exp. The timestamps are converted to UTC: iat is 2026-09-21T14:42:54Z and exp is one hour later. The signature is shown only as a byte count, and the status says clearly that it was not verified.
Reading the common claims
- iss (issuer): who created the token, usually an identity provider URL.
- sub (subject): the user or client the token is about.
- aud (audience): the API or application meant to accept it.
- exp, nbf, iat: expiry, not-before, and issued-at times, in Unix seconds.
- scope, roles, or groups: permissions, whose names vary by provider.
Decoding is useful for debugging login flows: checking whether a token has expired, whether the audience matches your API, or whether an expected claim is missing. It is never a basis for trust. Anyone can create a token with any claims. Only verifying the signature with the issuer's key, as your server-side library does, proves where it came from.
Frequently asked questions
Does this prove the token is valid?
No. It only decodes the contents. A token can be well-formed and still be expired, forged, or signed for a different audience.
Can I verify the signature here?
No. Signature verification needs the issuer’s key and is not part of this decoder.
What is the input limit?
Up to 32,000 characters, covering ordinary tokens.
Is it safe to paste a real token here?
The token is decoded in your browser and not sent anywhere. Still, a valid access token is a credential. Prefer expired or test tokens, and never paste production tokens into tools that do upload data.