JWT Decoder
Decode a JWT to see its header, payload and signature, with issued-at and expiry times converted to readable dates.
How it works
A JWT is three Base64URL segments joined by dots: header, payload and signature. The first two are just encoded JSON, so decoding needs no key at all — which is the single most important thing to understand about JWTs.
Timestamp claims are stored as seconds since 1970. They are converted here into your local date and time, and the token is marked expired when exp is in the past.
The formula
Structure
base64url(header) . base64url(payload) . signature
Standard claims
iss issuer · sub subject · aud audience · exp expiry · iat issued at · nbf not before
Timestamps
date = claim value × 1000 milliseconds
Worked examples
| Scenario | Working | Result |
|---|---|---|
| A token with exp in the past | exp × 1000 vs now | Marked expired |
| alg: HS256 | Read from the header | Symmetric HMAC signature |
| A malformed token | Fewer than three segments | Clear error, not a crash |
When you'd use it
- Checking why an API keeps returning 401
- Confirming which claims your auth provider is issuing
- Seeing exactly when a session token expires
- Inspecting a token during a support conversation
Common questions
Does this verify the signature?
No, and no browser tool should claim to — verification needs the secret or public key. Decoding proves nothing about authenticity, so never trust a decoded payload as evidence that a token is genuine.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and nothing is transmitted. Even so, treat any token you paste into any tool as potentially exposed, and rotate production tokens rather than reusing them afterwards.
Is the payload encrypted?
No. A standard JWT is signed, not encrypted — anyone holding it can read every claim. Never put passwords or sensitive personal data in a JWT payload.