JWT Decoder (Header, Payload, Expiry)
Paste a JSON Web Token and read its header and claims, with expiry and issue times as human dates — decoded on your device, not on a server.
| Claim | Value | Means |
|---|
Decoding is not verification. Anyone can read a JWT — this shows what it says, not whether its signature is genuine. Only the issuing server can check that.
Fast, easy and free — your answer appears as you type, and whatever you enter stays on your device.
Paste a JSON Web Token and read what is inside: the header, every claim pretty-printed, and the times — expiry, issue, not-before — turned into real dates with 'expires in 2 hours' phrasing. The token is decoded on your device and never transmitted, which matters, because a JWT is a credential.
How to use it
- Paste the tokenThe whole three-part string. A leading 'Bearer ' from a copied header is stripped automatically.
- Read the verdictValid or expired is the headline, with the exact expiry moment and how far away it is.
- Inspect the claimsHeader and payload as formatted JSON, time claims as a readable table, and the payload one tap from your clipboard.
What is actually inside a JWT
Three Base64url segments joined by dots. The header names the signing algorithm. The payload carries the claims — who the token is about (sub), who issued it (iss), who may accept it (aud), and the timestamps that bound its life. The third segment is the signature over the first two. Nothing is encrypted; the encoding exists to survive URLs and headers, not to conceal.
That transparency is why decoding is a daily debugging move: the answer to "why did the API reject this request" is very often sitting in the payload — an expired exp, a wrong audience, a missing scope — visible in the time it takes to paste.
Expiry first, because expiry is the question
In practice, people decode tokens to answer one question: is this thing still valid? So that answer is the big block at the top — valid or expired, the exact moment, and the distance from now in human terms. The full claims table is there for the deeper dig, but the 401-at-2am case is settled in one glance.
The relative times matter more than they look. Clock skew between servers routinely produces tokens that are "not valid yet" for a few seconds — an nbf a moment in the future is instantly visible when the table says "valid from in 30 seconds".
Decoded is not verified
The permanent warning under this tool is the most important sentence on the page. Anyone can mint a token claiming to be anyone — decoding it faithfully shows those claims. Only a signature check against the issuer's key separates a genuine token from a costume, and that check belongs to the server. Treat this page as reading glasses, never as a passport control.
And because a pasted token is a live credential: it stays on your device here, nothing is logged, and closing the tab destroys it.
Questions people ask
Is my token sent anywhere when I decode it?
No — and for this tool that is the headline feature, not a footnote. A live JWT grants access to whatever issued it; pasting one into a site that ships it to a server is handing over a key. Decoding here happens on your device. Even so, treat any token that has been through a clipboard as worth rotating.
Why can anyone decode a JWT — is that not broken?
By design, a JWT is readable by anyone holding it: the header and payload are just Base64url-encoded JSON. The signature does not hide the contents — it lets the issuing server detect tampering. Signed, not secret. The rule that follows: never put anything in a JWT payload you would not show the user carrying it.
Why will my token not decode?
The usual causes, in order: the token was truncated in copying (they are long, and logs cut them), an extra character came along, or it is not a JWT at all — opaque session tokens and API keys do not have the three dot-separated parts. The error message says which of these it saw.
What are exp, iat and nbf?
Unix timestamps controlling the token's lifetime: exp is when it stops being valid, iat when it was issued, nbf a time before which it must be rejected. This tool converts each to your local time and to relative terms, because 1787340000 tells a human nothing.
Can this tell me whether the token is genuine?
No, and be suspicious of any tool that claims to. Verifying the signature requires the issuer's secret or public key; without it, decoding shows what the token asserts, not whether the assertion is authentic. The warning under the tool is permanent for that reason.
My token says expired but the app still works — why?
Sessions usually pair a short-lived access token with a longer-lived refresh token; the app silently exchanges an expired access token for a fresh one. What you decoded is the access token's own lifetime — commonly minutes to an hour — not the length of your login.