JWT Decoder
This tool decodes JSON Web Tokens online. Paste a token and it restores the Header and Payload as JSON, explains standard claims such as iss, sub, exp and nbf, converts timestamps to your local time and flags whether the token is expired or not yet valid. It handles both JWS and JWE structures and decodes entirely on your device. Note that it does not verify signatures.
How to use it
- 1
Paste the token
Drop the JWT into the input — with or without a Bearer prefix and with or without surrounding quotes, both are recognised.
- 2
View header and payload
The tool performs base64url decoding and shows the header and payload separately as formatted JSON.
- 3
Check the claims
Standard claims get plain-language labels, time-based claims are converted to local time, and each is marked valid, expiring soon or expired.
- 4
Copy the result
The header and payload can be copied separately for debugging or record-keeping.
Key features
Handles many token shapes
Supports three-part JWS, two-part unsigned tokens and five-part JWE, and strips the Bearer prefix and surrounding quotes automatically.
Plain-language standard claims
iss, sub, aud, exp, nbf, iat and jti each get an explanation, with timestamps converted to local time at a glance.
Validity hints
Uses exp and nbf to tell whether the token is expired, not yet valid or about to expire, which speeds up auth debugging.
Explicitly no signature check
It only decodes and displays, and clearly states that the signature is not verified — so you never mistake "decodable" for "trustworthy".
Local processing
Decoding happens in your browser and the token is not uploaded; you can confirm this in the Network panel.
Open and go
No sign-in and no ads — paste a token and inspect it.
Common errors & troubleshooting
- ! Being able to decode a token does not make it valid: anyone can craft a decodable JWT, so signature verification must be done on the server with the key.
- ! A JWE (five-part) payload is ciphertext, so a front-end tool cannot decrypt it; this tool only parses the protected header and segment structure.
- ! If you paste a quoted string or a whole request header containing a Bearer prefix, paste it as-is — the tool cleans it up automatically.
- ! Compare the exp claim with your local clock to spot clock-skew problems that make a token appear expired before it really is.
Frequently asked questions
Does this tool verify the signature?
No. Verification requires the secret on the server; this tool only decodes and displays, so do not use it to decide whether a token is trustworthy.
Is my token uploaded?
No. Decoding happens locally in your browser with no network request, which you can confirm in the Network panel.
Why does exp show "expired" but the API still works?
The server may allow a tolerance window around the expiry time, or the token may not be used for authentication. Trust the server actual verification result over this display.
Is JWE (encrypted tokens) supported?
The tool recognises the five-part JWE structure and can read the protected header (alg / enc / kid), but the payload is ciphertext and cannot be decrypted in a pure front-end tool.
Related tools
JSON Formatter
Format, beautify and validate JSON in your browser. Errors point to the exact line and column, and you can indent with 2 spaces, 4 spaces or a tab.
JSON Tree Viewer
Render JSON as a collapsible tree with colour-coded types, search with ancestor expansion, JSONPath breadcrumbs, inline editing and windowed rendering for huge files.
JSON Escape / Unescape
Escape any text into a valid JSON string literal (newlines, tabs, quotes, backslashes) and unescape JSON string fragments back to their original text. Runs locally.
HTTP Request Client
A lightweight, browser-based HTTP client. Configure method, URL, headers and a JSON body, send the request and inspect status, timing, headers and the formatted JSON response.