JWT Decoder

The JWT Decoder splits a JSON Web Token into its three segments -- header, payload, and signature -- Base64URL-decodes the header and payload, and pretty-prints them as JSON. It also pulls out standard registered claims into a readable table, converting Unix timestamp claims like exp, iat, and nbf into human-readable dates and flagging whether the token has expired.

JWTs are used everywhere in modern authentication and API authorization, and debugging login flows, expired sessions, or unexpected claims often means inspecting a token by hand. Rather than writing a quick script or trusting an unknown third-party site with a session token, this tool lets you inspect a JWT instantly and locally.

A JWT has the shape header.payload.signature, where the header and payload are JSON objects encoded with Base64URL (a URL-safe Base64 variant using - and _ instead of + and /, with padding stripped). This tool restores standard Base64 padding, decodes each segment, and parses the result as JSON. The signature is displayed as-is because verifying it would require the secret or public key used to sign the token -- something this tool never has access to.

1. 1Paste a JWT into the input box, or click Load sample token to see it in action.
2. 2Review the decoded header for the signing algorithm and token type.
3. 3Review the decoded payload and the standard claims table for issuer, subject, audience and timing.
4. 4Check the expired/valid indicator based on the exp claim, if present.
5. 5Copy any section you need with the copy buttons.

• Assuming a decodable JWT is a valid, trusted one -- decoding proves nothing about authenticity without signature verification.
• Treating JWT contents as private -- the payload is plainly readable by anyone who has the token, since it's only encoded, not encrypted.
• Pasting real production or session tokens into online decoders, exposing live credentials to unnecessary risk.
• Confusing an expired token (exp claim in the past) with an invalid signature -- this tool only checks the former.

This tool never verifies signatures and never requests a signing key -- it is strictly a decoder for inspection and debugging. Because JWT payloads are visible to anyone holding the token, never place sensitive secrets (passwords, full card numbers, etc.) directly in claims. And because pasting a live token anywhere carries some risk if the token is still valid, prefer test or expired tokens when exploring a tool like this one.