JWT Decoder
Decode and inspect JSON Web Tokens
About JWT Decoder
Decodes a JSON Web Token (JWT) and displays its header and payload contents in readable form, useful for debugging authentication issues.
Paste your JWT, and the decoded header and payload are displayed automatically. A leading "Bearer " prefix and any line breaks are ignored. Time claims are shown in UTC and in your local time.
Decoding a JWT here reveals its contents but doesn't verify its cryptographic signature — a token can be decoded and read without confirming it's actually valid or unaltered.
Watch: JWT Decoder in Action
- Does decoding a JWT here confirm it's a valid, untampered token?
- No — decoding reveals a JWT's contents but doesn't verify its cryptographic signature. A token can be decoded and read without confirming it's actually valid or unaltered.
- Does this tool verify the signature of the token?
- No. It decodes the header and payload and nothing more; no key is involved and the signature part is not even shown. A token with a tampered payload decodes just as easily as a genuine one, so verification must happen in your own backend.
- Why does it say Invalid JWT format (expected 3 parts)?
- The text split on dots did not produce exactly three pieces. Typical causes are a copied token cut short, an extra space or quote, a Bearer prefix, or an encrypted token, which has five parts.
- What do the Issued at, Not before and Expires lines mean?
- They come from the iat, nbf and exp claims, which hold seconds since 1970. The tool shows each as a UTC time. Not before is the earliest moment the token should be accepted, and Expires is when it stops being valid.
- Can it show a payload with non-English characters?
- Yes. The decoded bytes are read as strict UTF-8, so names and messages in other scripts display correctly. If the bytes are not valid UTF-8, the tool reports Failed to decode JWT instead of showing garbled text.
- Why is a token marked Expired when my server still accepts it?
- The marker compares exp with your device's clock. If your computer's time is off, or the server allows some clock leeway, the two verdicts can differ. Check the exact timestamp shown in the Expires line against a trusted clock.
How to use JWT Decoder
Paste the full token into the JWT Token box. It should be three sections joined by dots: header, payload and signature. The tool decodes whenever the text changes, so there is no button to press, and the Header and Payload appear side by side as indented JSON.
If the payload holds numeric iat, nbf or exp claims, a panel below lists each one as a UTC timestamp in ISO format under the labels Issued at, Not before and Expires. The Expires line carries a red Expired or green Not expired marker that compares the time with your device clock.
If the token does not have exactly three dot-separated parts, you see Invalid JWT format (expected 3 parts). If a part is not valid Base64 text or does not parse as JSON, you see Failed to decode JWT.
When to use it
Use it when a login or API call returns a 401 and you want to see which audience, issuer or scope the token actually carries. It is also handy for checking whether a session token has already passed its exp time, comparing the claims of two tokens from different environments, or confirming which signing algorithm the header names before you configure a verifier.
When not to use it
Do not treat what you see here as proof that a token is genuine. Nothing is checked against a key, so a forged token decodes exactly like a real one. To decide whether to trust a token, verify its signature in your server code with your identity provider's library and keys. Also avoid pasting live production tokens into a shared screen or ticket, since anyone can read the payload.
Tips for best results
The decoder reads URL-safe Base64 and tolerates missing padding, so you can paste a token straight from a URL fragment. Remove a leading word such as Bearer first: the tool counts dot-separated parts, and the extra word would corrupt the header. Claims other than iat, nbf and exp are not converted, so a custom timestamp claim stays a raw number in the Payload box.
Limitations
This tool only decodes. It never checks the signature, the algorithm, the issuer or the audience, and the signature section is not displayed at all. The expiry marker compares against your device clock, which may be wrong. Only ordinary three-part tokens work; an encrypted token with five parts is rejected, and a payload that is not JSON cannot be shown.
Privacy
Splitting the token, Base64 decoding and JSON parsing all happen in your browser tab, and the Header and Payload panels are drawn from that local result. The token text is not sent to the site's servers. The only request tied to this tool is a usage record holding the tool name and a device identifier, never the token. Clear the box when you finish, since a token is a credential.
More from Security & Developer: