Skip to content
English
All tools

Categories

Developer ToolsEncoding & DecodingJSON & DataHash & ChecksumText ToolsDate & TimeNetwork ToolsFile ToolsMarkdown & Diagrams

JWT Decoder

Paste a JWT to read its header and payload as formatted JSON, with issue, not-before and expiry times translated to real dates. Decoding is not verification.

Processed locally in your browser

The token is decoded locally and never sent anywhere. Decoding does not verify the signature.0 chars · 0 lines
The result will appear here.

What is JWT Decoder?

A JSON Web Token (RFC 7519) has three Base64URL parts separated by dots: a header that names the algorithm, a payload with claims such as issuer, subject and expiry, and a signature. Anyone can read the first two parts, because they are only encoded, not encrypted.

This decoder strips an optional “Bearer ” prefix and stray whitespace, then shows the header and payload as pretty JSON, a summary of algorithm, type, issuer, subject and audience, iat/nbf/exp in UTC, local time and relative form (for example “expires in 2 h”), and the raw signature with its byte length.

How does it work?

  1. Paste the token, with or without the “Bearer ” prefix; line breaks are ignored.
  2. Read the warning first: the signature is not checked, so the claims are not trusted.
  3. Inspect the Header and Payload panels and the summary rows for algorithm, issuer, audience and the three time claims.
  4. Use the JWT Inspector for a security-oriented review or the Expiration Checker to test a specific moment.

Common use cases

  • Debugging which claims and scopes an identity provider actually put in an access token.
  • Checking why an API rejects a token: wrong audience, expired, or not valid yet.
  • Reading the kid and alg from a header while configuring a JWKS-based verifier.
  • Teaching how JWTs are structured with a safe demo token.

Examples

Try this input in the tool above:

Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEyMzQiLCJuYW1lIjoiRGVtbyBVc2VyIiwiaXNzIjoiaHR0cHM6Ly9hdXRoLmV4YW1wbGUudGVzdCIsImF1ZCI6ImRlbW8tYXBwIiwiaWF0IjoxNzAwMDAwMDAwLCJuYmYiOjE3MDAwMDAwMDAsImV4cCI6MTkwMDAwMDAwMCwianRpIjoiZGVtby0wMDAxIn0.ZHVtbXktc2lnbmF0dXJlLW5vdC1hLXJlYWwtaG1hYw
Output
Algorithm (alg): HS256
Type (typ): JWT
Issuer (iss): https://auth.example.test
Subject (sub): user-1234
Audience (aud): demo-app
Issued at (iat): 2023-11-14T22:13:20Z · local: Nov 14, 2023, 11:13:20 PM · issued 1044 d 22 h 42 min ago
Not before (nbf): 2023-11-14T22:13:20Z · local: Nov 14, 2023, 11:13:20 PM · started 1044 d 22 h 42 min ago
Expires (exp): 2030-03-17T17:46:40Z · local: Mar 17, 2030, 6:46:40 PM · expires in 1269 d 20 h 51 min
Signature (raw, NOT verified): ZHVtbXktc2lnbmF0dXJlLW5vdC1hLXJlYWwtaG1hYw (31 bytes)

Privacy

JWT Decoder runs entirely in your browser. The text or files you provide are processed on your device and are not uploaded, logged or stored on our servers.

Limitations

Decoded is not verified. This tool never checks the signature and cannot tell whether a token is genuine, so never trust its contents for an access decision. Only decode tokens you are allowed to handle; treat real ones as credentials.

Frequently asked questions

Does this tool verify the JWT signature?

No. Verification needs the secret or public key and must happen on your server. This page only decodes the readable parts, and it labels the result as unverified on purpose.

Is my token sent to a server?

No. Decoding happens locally in your browser; nothing is uploaded or stored. Even so, avoid pasting production tokens into any tool you do not control.

Why can I read the payload without a key?

A standard signed JWT (JWS) is only Base64URL-encoded. The signature protects against tampering, not against reading. Use an encrypted token (JWE) if the content must stay private.

Related tools

More tools in Developer Tools →