JWT Decoder

Decode a JSON Web Token

Header

-

Payload

-

Signature

-

Decoding is not verification: this tool reads the token's contents but does NOT check the signature, so it cannot tell you whether a token is genuine or was issued by your server.

Paste a JSON Web Token into this free JWT Decoder and read what is inside it: the header and payload are base64url-decoded and shown as tidy, pretty-printed JSON, and the time claims are translated into human dates. If the token has an exp (expiry) claim, the tool converts it to a readable date and tells you plainly whether the token is expired or still within its expiry time; iat (issued at) is converted too. It is the quickest way to answer everyday debugging questions - why did this token stop working, which user and roles does it carry, when exactly does it expire - without printing secrets into a server log.

The important limit, stated up front: decoding is not verification. A JWT's payload is only encoded, not encrypted, so anyone holding the token can read it (never put secrets in a payload) - and this tool does not check the signature, so it cannot tell you whether a token is genuine, untampered or really issued by your server. Treat the output as "what this token claims", and let your server's signature check decide whether to trust it. The token is decoded entirely in your browser and never uploaded anywhere, which is exactly how tokens should be handled while debugging.

How to use

  1. Copy the full JWT - all three parts separated by dots - from your app, browser storage or API response.
  2. Paste it into the box.
  3. Click "Decode token".
  4. Read the header (algorithm and type) and the payload (the claims).
  5. Check the status line for the issued-at and expiry dates and the expired / still-valid verdict.

Frequently asked questions

Does this tool verify the token's signature?

No - and it says so on the card, because the difference matters. This decoder reads the header and payload; it does not have your signing key and does not check the signature, so a tampered token would decode just as happily as a real one. Only your server, verifying the signature with the correct key or public key, can establish that a token is genuine.

What do exp, iat and sub mean?

They are standard JWT claims. exp is the expiry time (seconds since the Unix epoch) after which the token must be rejected; iat is when it was issued; sub is the subject - usually the user ID the token belongs to. Others you will often see: iss (issuer), aud (audience) and nbf (not valid before). This tool converts exp and iat into readable dates and shows every claim in the payload as-is.

Why did my token expire so quickly?

Short lifetimes are deliberate - access tokens commonly live for minutes to an hour so a leaked token does limited damage, with a separate refresh token used to get new ones. If the decoded exp is much sooner than you expected, check whether you are looking at an access token rather than an ID or refresh token, and whether the issuing server's clock is correct.

Is it safe to paste a real token here?

The decoding happens in JavaScript in this page; the token is never uploaded, stored or logged. That said, good practice still applies: a live token is a credential, so avoid pasting one anywhere you do not have to, and if a token has been shared publicly, treat it as compromised and revoke it.

Related Tools

More free developer tools from ToolVora - every tool runs entirely in your browser, with no sign-up and no uploads: