JWT Decoder

Paste any JWT to inspect its header, payload, and signature. Expiry timestamps are surfaced and live-checked against your clock.

  • Runs in browser
  • No signup
  • No tracking
Share

How to use JWT Decoder

  1. Paste your JWT into the input box.

  2. Header and payload appear as formatted JSON.

  3. Check the Valid / Expired indicator.

  4. Inspect iat and exp timestamps below the payload.

When to use it

  • Debugging why a token is being rejected by an API.

  • Inspecting the payload of a suspicious token.

  • Verifying iat / exp claims in tests.

  • Confirming the signing algorithm (HS256 vs RS256).

What it fixes

  • Tokens with malformed base64 padding silently failing.

  • Encoded payloads hidden behind a CLI wall.

  • No quick way to check if a token is expired without parsing it.

About JWT Decoder

JWTs are three base64url-encoded segments separated by dots: header.payload.signature. The first two contain JSON metadata you can read; the third is a binary signature.

This tool parses the segments and pretty-prints the JSON. It also detects iat (issued-at) and exp (expiry) claims, formats them as UTC, and flags expired tokens.

References: RFC 7519 — JSON Web Token · RFC 7515 — JWS

Frequently asked

  • Does this verify the signature?

    No — this is a decoder, not a verifier. Signature verification needs the secret or public key, which Pro adds. The token is parsed and displayed, not validated.

  • Is my token sent anywhere?

    No. Decoding runs entirely in your browser. The token never leaves the page.

  • What does the expiry indicator check?

    It compares the exp claim (Unix seconds) against your browser's clock and labels the token Expired or Valid.

Discussion

All tools