JWT Decoder

What this tool does

A JSON Web Token is three Base64URL segments: the header (algorithm and type), the payload (claims such as user ID, roles, and expiry), and the signature. This tool splits the three parts, pretty-prints header and payload as JSON, and converts Unix-timestamp claims like exp, iat, and nbf into readable dates so you can see at a glance when the token was issued and when it expires.

Decoding happens entirely in your browser. Still, prefer test-environment tokens — this site never uploads anything, but pasting production tokens into any web page is a habit worth avoiding.

Typical use cases

When an API suddenly returns 401, decode the token and check exp first. When integrating a third-party platform, confirm which claims it actually issued. When debugging permissions, verify the role and scope fields. All much faster than printing tokens into logs and squinting.

Caveats

The most important point: decoding is not verification. Anyone can read and modify the Base64URL sections of a JWT; this tool only reads it and does not check the signature. A server must verify the signature with its secret before trusting any claim. Never make security decisions client-side from a decoded payload, and treat alg=none, weak algorithms, or an expired exp as invalid tokens.