JWT Decoder
A tool that breaks a JWT (JSON Web Token) string down into its Header, Payload, and Signature, displaying each as formatted JSON. It automatically converts Unix timestamp claims like exp and nbf into readable dates and warns when a token has expired. It does not verify the signature.
How to use
- Paste a JWT (JSON Web Token) string into the input field.
- The Header and Payload are automatically shown as formatted JSON.
- If the payload contains Unix timestamp claims like exp or nbf, a list showing them converted to readable dates is displayed, along with a warning badge if the token has expired.
- The Signature is shown decoded as-is (as a Base64URL string).
About this tool
This tool breaks a JWT (JSON Web Token) string down into its three parts — Header, Payload, and Signature — and lets you inspect each one. It's useful for debugging the contents of an issued token while implementing authentication or authorization.
A JWT's Header and Payload are Base64URL-encoded JSON. This tool decodes and formats them, and automatically converts standard claim timestamps like `exp` (expiry), `nbf` (not before), and `iat` (issued at) into human-readable dates.
This tool only visualizes the token's contents — it does not verify the signature. Confirming whether a signature is valid requires server-side verification using the issuer's secret or public key.
Frequently asked questions
Can this tool verify whether the signature is valid?
No. Verifying a signature requires the private or public key used to issue the JWT, which this tool doesn't handle — it only decodes and displays the contents of the Header and Payload.
When does it show "Expired"?
It's shown when the payload contains an exp claim and its value is earlier than the current time. Conversely, if the nbf (not before) claim is in the future, "Not yet valid" is shown.
Why can't my pasted JWT be decoded?
A JWT must have three parts — header, payload, and signature — separated by periods. Check that no extra whitespace or line breaks were included when copying, and that all three parts are present.
Is my input JWT sent to a server?
No. Decoding all happens with JavaScript in your browser and is never sent externally. That said, pasting a real authentication token into any third-party tool carries some inherent risk, so please handle tokens with care.