Header and payload segments are decoded from Base64URL and parsed as JSON. No signature key is supplied, and decoded claims are not treated as trusted.
24
Data & developer
JWT Decoder
Decodes the Base64URL header and payload of a JSON Web Token in the browser and explains exp, iat, and nbf times. It does not verify the signature or send the token to a server.
✓ Free✓ No account✓ In-browser
QUICK ANSWER
What does this tool do?
Read JWT header and payload as local JSON without verifying the signature.
ResultReady
Your result will appear here.
APPLICATION AND DECISION GUIDE
JWT Decoder: method and usage
Decodes the Base64URL header and payload of a JSON Web Token in the browser and explains exp, iat, and nbf times. It does not verify the signature or send the token to a server.
Enter a JWT in dot-separated header.payload.signature form. Use a synthetic token for a trial; a real session token may grant access to its holder. Confirm the shape first with a small example containing no personal data.
Header and payload fields become readable. alg declares an algorithm; sub, iss, aud, and exp are claims made by the issuer, not verification results.
Practical steps
- Paste a non-sensitive test JWT.
- Decode its header, payload, and time claims.
- Remember that decoding does not verify the signature.
Compare a synthetic payload's user identifier and expiry with known values. exp uses seconds; interpreting it as milliseconds produces the wrong date.
Decoding does not validate a signature, issuer, audience, or authorization. Authentication requires server-side verification with the correct key and allowed algorithm; do not share live tokens.
Suitable use cases
- Authentication debugging
- Inspecting claims
- Checking token expiry
Worked decision record
Read `iss`, `aud`, `exp`, and role claims while diagnosing a session issue—without treating them as proof of identity.
Use a synthetic JWT only. Put an expired `exp`, the expected test `aud`, and a non-personal sample role in its payload.
Header and payload appear as separate valid JSON, and the Unix time can be converted to a readable date. The page clearly states that the signature was not verified.
Do not trust decoded claims. Make no access or identity decision until signature, algorithm, key, issuer, and audience are verified server-side.
LEARN THE WORKFLOW
Guides for this tool
Turn a cURL Command into Safer Application Code
Harden generated code with secret management, timeouts, error checks, and correct payload encoding.
Read guide →A Systematic Workflow for Debugging JSON, JWTs, and APIs
Trace malformed bodies, encoding mistakes, expiry, and JWT claims in a safe, repeatable order.
Read guide →ABOUT THIS TOOL
Frequently asked questions
What input does JWT Decoder accept?+
Enter a JWT in dot-separated header.payload.signature form. Use a synthetic token for a trial; a real session token may grant access to its holder. Use a synthetic JWT only. Put an expired `exp`, the expected test `aud`, and a non-personal sample role in its payload.
What does JWT Decoder return?+
Header and payload fields become readable. alg declares an algorithm; sub, iss, aud, and exp are claims made by the issuer, not verification results. Header and payload appear as separate valid JSON, and the Unix time can be converted to a readable date. The page clearly states that the signature was not verified.
How should I validate JWT Decoder output?+
Compare a synthetic payload's user identifier and expiry with known values. exp uses seconds; interpreting it as milliseconds produces the wrong date. Do not trust decoded claims. Make no access or identity decision until signature, algorithm, key, issuer, and audience are verified server-side.
Does JWT Decoder send or store input on a server?+
Tool input is processed in the active tab. Saving to the Workstation or transferring to another tool is a separate choice. Consider browser extensions and shared devices separately; the privacy page explains advertising and network connections.