JWT Decoder
Inspect JSON Web Tokens
About this tool
Paste a JSON Web Token to decode its header and payload into readable JSON. Timestamps such as exp and iat are converted to human-readable dates so you can verify claims quickly.
This decoder is for inspection only: it does not verify signatures. Use it to debug auth flows, check scopes, and confirm expiry, privately in your browser.
How to use it
- Paste the full JWT (header.payload.signature) into the input.
- Review the decoded header and payload panels.
- Check exp, iat, and nbf dates if present.
- Copy any claim you need for debugging or documentation.
Common use cases
- Inspect access tokens during OAuth or API debugging.
- Confirm roles, scopes, and audience claims without a backend.
- Check whether a token is expired before retrying a request.
- Teach or document JWT structure with real examples (never share secrets).
Frequently asked questions
Does this verify the JWT signature?
No. It only decodes the Base64URL segments. Signature verification requires the signing key on a trusted server.
Is my token uploaded?
No. Decoding happens entirely in your browser.
Why are dates shown specially?
Common time claims (exp, iat, nbf) are converted from Unix timestamps to readable local and UTC dates.
What if the token is malformed?
You will see a clear error. Ensure the token has three dot-separated parts.
Can I encode a new JWT here?
This tool focuses on safe, local decoding for inspection. Creating signed tokens belongs in your auth service.