JWT Decoder
Paste a JSON Web Token to read its header and payload, check when it was issued and when it expires — all decoded locally.
About this tool
A 401 from the API, a login that mysteriously expires, a claim that is not where the docs say it should be — debugging authentication usually means looking inside the token. This free JWT decoder splits a JSON Web Token into its three parts and shows the header (algorithm and type) and payload as colour-coded, pretty-printed JSON, plus the raw signature. Time-based claims are translated for you: iat, exp and nbf become readable local and UTC dates with an at-a-glance status such as "expires in 2 hours" or "expired 3 days ago".
Decoding happens entirely in your browser — the token is never sent to a server, logged or stored, which matters because a live access token is as sensitive as a password. Be clear about what this tool does not do: it never verifies the signature. A JWT's contents are merely base64url-encoded, so anyone can read them; proving they came from the issuer requires the secret or public key and belongs in your backend, not in a web page.
How to decode a JWT
- Paste the token (a leading
Bearerprefix is fine) into the box — decoding is instant. - Read the header and payload JSON, and check the issued/expiry dates and status.
- Use Paste example to see a sample token, or Clear to start over.
Frequently asked questions
Is it safe to paste a real token here?
The token is decoded by JavaScript in your browser and is never transmitted, logged or stored, so nothing leaves your device. Still treat access tokens like passwords: anyone who obtains one can use it until it expires, so avoid pasting production tokens on shared machines.
Does this tool verify the signature?
No. The header and payload of a JWT are only base64url-encoded, not encrypted, so they can be read without any key — that is all this tool does. Checking the signature requires the issuer's secret or public key, which you should only ever use in your own backend code.
What do iat, exp and nbf mean?
They are registered claims holding Unix timestamps in seconds: iat is when the token was issued, exp is when it stops being valid, and nbf (not before) is the earliest moment it may be used. The tool converts each one to a readable date and shows whether the token is currently expired, not yet valid or active.
Why does it say my token is malformed?
A JWS-style JWT must have exactly three base64url parts separated by dots, and the first two must decode to JSON objects. Common causes are a truncated copy, surrounding quotes or whitespace, or pasting a five-part JWE, which is encrypted and cannot be decoded without the key.
Can I decode tokens from Auth0, Firebase, AWS Cognito or Azure AD?
Yes. Those services all issue standard JWTs, so their ID tokens and access tokens decode the same way — you will see claims like iss, aud, sub, email and any custom namespaced fields. Opaque or reference tokens from some providers are not JWTs and will not decode.