JWT Decoder
Decode a JSON Web Token to read its header, payload and claims, with exp, iat and nbf turned into readable dates and expiry flagged. Decoding happens locally and the tool never claims a signature is valid.
Network ToolsHow to use JWT Decoder
- Paste the token into the input panel. A leading "Bearer " prefix is stripped automatically.
- The header and payload are decoded immediately and shown as formatted JSON.
- Read the claims table for a plain-English explanation of each registered claim.
- Check the exp row: expired tokens are flagged in red with how long ago they lapsed.
- Copy the header or payload JSON if you need it elsewhere.
Examples
A token's three parts
Header, payload and signature, separated by dots. The first two are Base64url-encoded JSON.
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.SflKxwRJSMeKKF2QT4fwpM
A decoded payload
Numeric date claims are seconds since the Unix epoch.
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1516242622
}Features
- Decodes header and payload, and shows the raw signature
- Registered claims explained: iss, sub, aud, exp, nbf, iat, jti and more
- exp, iat and nbf rendered as UTC timestamps with a relative description
- Expired and not-yet-valid tokens are flagged clearly
- Handles Base64url with or without padding, and strips a Bearer prefix
- Distinguishes a malformed token from a JWE, which cannot be decoded without a key
- Copy buttons for the decoded header and payload
- Runs entirely in your browser — tokens are never transmitted
Frequently asked questions
- Does this verify the signature?
- No, and that distinction matters. Verifying requires the issuer's secret or public key, which should never be pasted into a web page. This tool decodes; your server must verify.
- If anyone can decode a JWT, is the payload secret?
- No. A JWT is signed, not encrypted — the payload is Base64url, which is an encoding anyone can reverse. Never put anything confidential in a JWT payload.
- What do exp, iat and nbf mean?
- exp is the expiry time, after which the token must be rejected. iat is when it was issued. nbf is the earliest time it may be accepted. All three are seconds since the Unix epoch, which is why this page renders them as dates.
- Is it safe to paste a real token here?
- The token never leaves your browser, so no data is transmitted. But a token is a credential: if you are on a shared or untrusted machine, treat any token you handle there as compromised regardless of the tool.
- Why does my token have five parts?
- Five dot-separated parts means a JWE — an encrypted token — rather than a JWS. Its contents cannot be read without the decryption key, so no decoder can show you the payload.
- The header says alg: none. What does that mean?
- It means the token claims to be unsigned. Accepting such a token is a well-known vulnerability, because anyone can forge one. A verifier should reject alg: none outright.
Related tools
About JWT Decoder
JWT Decoder is part of Network Tools on ToolHive, a growing collection of small, focused utilities for developers, designers and students. Decode tokens, inspect URLs and understand what travels over the wire. Everything runs client-side, so your data never leaves the browser tab — which makes these tools safe to use with work-in-progress code and private content.