Developer Utility
JWT Decoder Online
Decode JSON Web Tokens, inspect header and payload claims, and check expiration dates directly in your browser. Decoding does not verify a token's signature.
Decode your JWT instantly
Inspect token structure, JSON claims, and expiration locally in your browser. Decoding does not verify the signature.
Encoded token
Privacy: JWT decoding runs locally in your browser. Avoid sharing sensitive tokens or pasting them into untrusted websites.
Quick Answer
What is a JWT Decoder?
A JWT Decoder reads the Base64URL-encoded header and payload of a JSON Web Token and displays their JSON contents. It helps developers inspect authentication claims, token timestamps, and other metadata.
How It Works
How to decode a JWT token
- Copy a test JWT token.
- Paste it into the decoder above.
- Inspect the decoded header and payload.
- Check the exp, iat, and nbf timestamps.
- Copy the decoded JSON when needed.
The decoding process runs locally in your browser. Avoid entering real session tokens or sensitive credentials.
Understanding JWT
What are the three parts of a JWT?
A compact signed JWT commonly contains three dot-separated segments: header, payload, and signature.
The header describes the token type and signing algorithm. The payload contains claims such as the subject, issuer, audience, and timestamps. The signature is used to verify integrity and authenticity when checked with an appropriate key and algorithm.
header.payload.signatureThis tool decodes the header and payload but does not cryptographically verify the signature.
JWT Claims
What do exp, iat, and nbf mean?
exp specifies the expiration time. iat indicates when the token was issued. nbf specifies the earliest time at which the token should be accepted.
These values are typically represented as Unix timestamps in seconds. The decoder converts them into readable dates for easier inspection.
Frequently Asked Questions
JWT Decoder FAQ
Can I decode a JWT without the secret key?
Yes. JWT headers and payloads are encoded, not encrypted. You can decode them without a secret key. However, verifying a signed token requires the appropriate key and verification procedure.
Does decoding a JWT verify its signature?
No. Decoding only reveals the encoded information. It does not establish that the token is authentic, trustworthy, or correctly signed.
How can I check whether a JWT has expired?
Inspect the exp claim and compare its Unix timestamp with the current time. An expired timestamp indicates that the token is past its stated expiration, but expiration alone does not establish token validity.
Is a JWT payload encrypted?
A standard signed JWT payload is not encrypted. Anyone possessing the token can generally decode its contents. Sensitive information should not be placed in an unencrypted JWT payload.
Related Tools
More developer utilities
Explore our JSON Formatter, JSON Validator, Base64 Encoder & Decoder, and Timestamp Converter.