JWT Decoder

What is a JWT?

A JWT (JSON Web Token) is a compact, URL-safe token format used to carry claims between two parties — most often to prove that a user is logged in. A JWT is a single string made of three base64url-encoded segments joined by dots: header.payload.signature. The header states the signing algorithm (for example HS256 or RS256) and the token type; the payload holds the claims, such as sub (subject), iss (issuer) and exp (expiry time); and the signature is produced by the issuer with a secret or private key so the token cannot be tampered with.

How to use this tool

1. Paste a JWT into the input box above — it is decoded live as you paste or type.
2. Inspect the decoded header and payload, pretty-printed as JSON.
3. Check the claims table: exp, iat and nbf are rendered as human-readable UTC times, and exp gets an Expired/Valid badge.
4. Click Copy payload to copy the decoded payload JSON to your clipboard.

Why you must still verify the signature server-side

Decoding a JWT is not verifying it. Base64url is an encoding, not encryption — anyone can read, change and re-encode the payload of a token without knowing any secret. This tool deliberately does not verify the signature; it only shows you what the token says.

• Never trust claims from a decoded token until the signature has been verified with the issuer's secret or public key.
• Always verify on the server: check the signature, the algorithm, and the exp, nbf, iss and aud claims before granting access.
• Privacy: this decoder runs entirely in your browser, so the token never leaves your device — but still treat real tokens like passwords and avoid pasting production tokens into any website.

Common mistakes when decoding a JWT

• Pasting the "Bearer " prefix. Tokens copied from an Authorization header start with "Bearer ", which is not part of the JWT. Strip it first, or the header segment will not parse as base64url JSON.
• Pasting an incomplete token. A JWT has exactly three dot-separated segments; if the status line reports a different segment count, the copy was truncated — re-copy the full string from the source.
• Reading timestamps as milliseconds. JWT NumericDate values are seconds since the Unix epoch, not milliseconds. A 13-digit value such as 1757000000000 is milliseconds; the correct seconds value is 1757000000. Passed as seconds, a millisecond value renders as a date tens of thousands of years in the future — a reliable sign of the mix-up.
• Assuming an empty third segment is an error. An unsecured JWT (alg "none") legitimately ends with a trailing dot and no signature; the tool flags this as an empty signature segment rather than failing.

Tip: if you do not have a token handy, click Sample token to generate one with fresh iat and exp values, so the claims table shows a Valid badge.

Frequently asked questions